Feature Request: Exclude List

[joelp172]

To add an exclude list (a configurable denylist) that always masks specific text or regex patterns, even if they are not detected as PII by Presidio (or fall below score_threshold). This would complement the existing masking.whitelist, which prevents masking for known-safe terms.

PasteGuard currently supports masking.whitelist to exclude patterns from masking (helpful for false positives). There are cases where teams need the inverse control: force masking for known sensitive identifiers that may not be consistently detected as PII

[sgasser]

Thanks for the request! Planning to add denylist as the inverse of whitelist:

masking:
  denylist:
    - pattern: "ProjectX"
      type: PROJECT_NAME
    - pattern: "CUST-\\d{6}"
      type: CUSTOMER_ID

• pattern: fixed string or regex
• type: required — used for placeholder (e.g., [[CUSTOMER_ID_1]])

What's your use case? Curious what patterns you're looking to force-mask.

[joelp172]

Yes exactly that: a configurable denylist/exclude list for terms you always want masked, even if they’re not flagged as PII.

Examples of what typically can be missed:

• Company names / internal org names
• Project and product code names (e.g., ProjectX)
• Customer identifiers
• Abbreviations and acronyms you consider sensitive in context (e.g., FBI, CIA just as examples!)
• Internal system names and environment names

I'm using it in conjunction with Kerlig, and in some contexts such as slack, names and codewords can often get missed.