UnitAutogen
Database
PostgreSQL / Supabase SQL Server Oracle + EDB
Account

pii, personal data in error messages (Enterprise)

The PII audit is part of every security pass. unitautogen seccover and unitautogen hipaa run it by default, and unitautogen pii is the same pass under its own name. It invokes each routine so that its error and RAISE paths run, then checks the messages for personal data such as names, emails and card-like numbers. A function that echoes a row into an exception message is exactly what it catches. Enterprise edition.

unitautogen pii --schema public --out sec_out

What it writes

  • The full seccover output and pgTAP tests in <out>/security/<schema>/
  • <out>/pii_tests/pii_findings.json, always
  • The PII-in-error report <out>/pii_tests/pii_report.html, only when something leaks
  • A clean run shows "ran clean" on the PII card of the Data security coverage report

It takes the same options as seccover. Use --config FILE to declare personal-data columns the tool does not recognise, see the config file. --no-pii-audit turns it off inside seccover and hipaa.

Besides the usual personal data it recognises PHI by column name. That includes medical record numbers, health plan and insurance IDs, diagnosis and ICD codes, medication and prescriptions, lab results and other clinical data, and provider IDs. TG_NO_PHI_NAMES=1 turns this off.

On Supabase, the security tests go to supabase/tests/seccover/security/ and run under supabase test db. The findings go to supabase/tests/seccover/pii_tests/ as a report, not as tests.

The PII-in-error report

Every exception and RAISE path is driven with an injected fault so the handler really runs, and its output is checked for personal data.

PII-in-error report listing the leaking triggers and the columns they expose
A run against a fixture that leaks. 5 routines and 7 findings, 7 confirmed and 1 not audited. Each row names the routine, where it leaks, the pattern and the exact source, here patient.email and patient.full_name.
Report elementWhat it shows
CountersRoutines leaking PII, total findings, confirmed and possible, and not audited.
Patterncolumn-emit, a column value written into the message. raise-exposure, a RAISE puts a column or argument into the error. error-passthrough, the handler re-emits the caught error. context-exposure, the error context is re-emitted.
Severityconfirmed, a value classified as PII reached the output. echo, a handler re-emitting diagnostics. not-audited, the handler could not be driven, so it is neither cleared nor blamed.

Every leak is proven, never inferred from the source. A canary value has to surface in the handler's output under the injected fault before it is listed. When nothing leaks, the report says no PII-in-error leaks were found in the handlers it ran.

Use it to

  • Catch routines that echo names, emails or card-like numbers into error messages before those messages reach logs or clients