CODING CHALLENGE · N°61

PII Redactor

Medium FDESecurityCompliance

Before customer data touches a log line — or a third-party LLM — the personal bits have to go. Mask emails, SSNs, credit cards, and phone numbers with pattern matching, leaving the rest readable. It’s the redaction step that keeps you out of a compliance incident. Solve it in Python or TypeScript, with hidden tests.

The problem

Implement redact(text): replace personal data with typed placeholders, in this order — emails → [EMAIL], US SSNs (###-##-####) → [SSN], 16-digit credit cards (optionally space/dash grouped) → [CARD], and phone numbers (###-###-#### or ###.###.####) → [PHONE]. Everything else is left untouched. Return the redacted string.

EXAMPLE 1

Input text = 'mail a@b.com ssn 123-45-6789 ph 555-123-4567'

Output mail [EMAIL] ssn [SSN] ph [PHONE]

each pattern is masked with its type

CONSTRAINTS

Apply the patterns in the given order (email, SSN, card, phone) so a card isn’t mis-tagged as a phone.
Replace with the typed token ([EMAIL], [SSN], [CARD], [PHONE]) — keep the surrounding text.
Non-matching text passes through unchanged.

SOLVE IT YOURSELF

Your turn — write it

Edit the stub, hit Run (or ⌘/Ctrl + Enter), and watch the hidden tests. Stuck? the hints are right above and Reveal solution is one click away.

YOUR TASK

Implement redact(text) with four ordered regex replacements. Use word boundaries so you match whole tokens, and apply email first (its "@" is unambiguous) and card before phone (a 16-digit run must not be split into phone-shaped pieces).

HINTS — 4 IDEAS

Email: [A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,} → [EMAIL].
SSN: \b\d{3}-\d{2}-\d{4}\b → [SSN].
Card: \b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b → [CARD] (before phone).
Phone: \b\d{3}[-.]\d{3}[-.]\d{4}\b → [PHONE].

CPython · WebAssembly

Approach, complexity & discussion — open after you solve

The approach

Match each PII pattern — emails, phone numbers, SSNs, credit cards — and replace the match with a placeholder. Order matters: redact the more specific and longer patterns first so a partial match does not shadow a fuller one. Where you can, validate the match (e.g. the Luhn checksum for card numbers) to cut false positives.

Complexity

Time O(n × patterns) in the text length.

Common mistakes

Over-broad regexes that redact things that are not PII (false positives).
Missing formats — international phone numbers, obfuscated emails, spaced-out card numbers.
Redacting after the data has already been logged instead of before it leaves your boundary.

Where this shows up

PII redaction is a compliance necessity wherever user data flows into logs, analytics, or LLM prompts — you scrub before the data crosses your trust boundary. It is especially critical when feeding user text to third-party AI tools, which is exactly the “never leak customer data” rule from working with AI safely.

Finished this one? 0 / 75 Challenges done

Explore the topic

See this alongside everything else on the same subject — handbooks, system designs, challenges and tools, in one place.

Forward Deployed Engineering