Drop it in the bag
Not allowed on board
🎯 Can you beat it?
- Type an NRIC in lower case, or put
+65before a phone number. - Change one letter of an NRIC: it's still caught, as a mistyped ID.
- Rename the file to
.envorserver.pem: the whole bag stays behind. - Hide an instruction in a comment: it's reported to a person, not obeyed.
🙈 What it can't catch yet
- People's names and home addresses: type one and watch it go through. That needs smarter detection, planned for later.
- A short, plain password with no hint that it's a password.
- It's cautious with long numbers: some ordinary 8-digit numbers get wrapped as phone numbers. That costs context, never data.
🔍 Is this really the product?
- Yes: the checks are Vetted v0.1.0's own code (commit
2ae958e), bundled for the browser. - Secrets: 221 rules from gitleaks plus a randomness check. Singapore data: sg-pii-rules.
- In the real project, 144 fake secrets and IDs went through it: 0 leaks. The AI's comment here is a fixed template; Vetted itself asks a real AI model.