Shared libraries

DataMask

Mask a phone, PAN, card, or connection string before it is logged

Static masking for phone, email, card, Aadhaar, PAN, GSTIN, JWT, API key, connection string, and named JSON properties. null returns an empty string. A value that does not match the expected shape is masked entirely. Version 0.1.1 is in source and is not on nuget.org yet.

GitHub

Install

dotnet add package NuvyntraLabs.NET.DataMask

Package ID: NuvyntraLabs.NET.DataMask

NuvyntraLabs.NET.* is a class library, not a Plugin.Maui.* package. The install command applies after 0.1.1 is published. Until then, reference the project in the hub submodule.

Example

DataMask.Phone("9876543210");          // ******3210
DataMask.Email("john.doe@gmail.com");  // j*******@gmail.com
DataMask.Card("4111 1111 1111 1111");  // **** **** **** 1111
DataMask.Pan("ABCDE1234F");            // *****1234F
DataMask.ConnectionString("Server=localhost;Password=secret;User Id=sa");
                                     // Server=localhost;Password=***;User Id=sa

Overview

NuvyntraLabs.NET.DataMask hides a known sensitive string before it hits a log. These methods do not throw. Prefer Microsoft.Extensions.Compliance.Redaction when the host already classifies data. Extension methods (MaskPhone, MaskEmail, MaskCard, MaskAadhaar, MaskPan, MaskGstin) live in NuvyntraLabs.NET.DataMask.Extensions so a global using does not attach them to every string. Card masking is a logging aid, not a PCI scope reduction. There is no dedicated CVV method.

Capabilities

Phone and card keep the last 4 digits. Separators stay. Fewer than 4 digits masks the whole string.
Email keeps the first character of the local part and the domain.
Aadhaar keeps the last 4 digits as **** **** nnnn when 12 digits remain.
PAN keeps the four digits and the final character. GSTIN keeps the first 2 and last 3 of a 15-character id.
JWT keeps the header segment. An API key of at least 12 characters keeps the first 4 and last 4.
Connection strings keep non-secret keys. Password, Pwd, AccountKey, SharedAccessKey, SharedAccessSignature, AccessToken, ClientSecret, and ApiKey become ***.
JSON walks nested objects and arrays. Default names include password, token, pan, aadhaar, gstin, card, and cvv. Match is ordinal ignore-case.

.NET
Logging
Redaction

Discussion

Comment on NuvyntraLabs.NET.DataMask. The thread lives on this component's GitHub repository. Sign in with GitHub — Giscus uses Discussions, Utterances uses Issues.

Issues are not enabled on this repository

Open the conversation on GitHub, or use the Giscus tab if Discussions are available.