Skip to content

docs: clarify inherited local safety matcher limits - #264

Merged
senamakel merged 2 commits into
mainfrom
docs-local-safety-limits-263
Oct 11, 2026
Merged

senamakel merged 2 commits into
mainfrom
docs-local-safety-limits-263

Conversation

@senamakel

@senamakel senamakel commented Oct 11, 2026 •

Copy link
Copy Markdown
Member

Document the inherited IBAN, phone, PAN/CVV, and international-phone matcher limits with actionable follow-up links (#260, #261, #262, #263). Correct the phone rule comment to describe its separator-inclusive quantifier. Detection and redaction behavior remain unchanged. Follow-up to #259.

Validation: tinymemory-api formatting and strict all-feature API documentation passed.

Summary by CodeRabbit

  • Documentation
    • Clarified known limitations in safety detection, including cases involving grouped IBANs, overlapping phone rules, card boundaries, and international phone number matching.

senamakel and others added 2 commits October 11, 2026 19:38
The safety README now records the known inherited limitations that remain
unchanged by the ownership move, covering grouped IBANs, overlapping phone
rules, card boundaries, and international phone repetition. The international
phone rule comment was also updated to note that its repetition counts
separators rather than normalized digits, with the digit bounds tracked as
follow-up #263.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-11T16:47:19.099450Z 3e671af PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 02671a08-3350-49cc-83df-ada03d655011


📥 Commits

Reviewing files that changed from the base of the PR and between 759fbae and 3e671af.



📒 Files selected for processing (2)
  • crates/tinymemory-api/src/safety/README.md
  • crates/tinymemory-api/src/safety/rules.rs


Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.




📝 Walkthrough
📝 Walkthrough

Walkthrough

The safety README now lists four existing detection limitations. A comment for the international phone rule clarifies its separator-based repetition. The regex and rule behavior are unchanged.

Changes

Safety detector documentation

Layer / File(s) Summary
Document detector limitations
crates/tinymemory-api/src/safety/README.md, crates/tinymemory-api/src/safety/rules.rs
The README describes four inherited detection limitations. The rule comment notes that the international phone pattern counts separators and that normalized digit bounds remain deferred.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other



Merge Risk: ⚪ Minimal · up to 3e671

This documentation change accurately describes existing detector limitations without changing detection behavior; no merge-blocking risk was identified.

Architecture Summary

Architecture risk: 🔵 Low · up to 3e671

The change affects 1 system.

Changed systems: crates

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

  • observed — crates (service) was modified; 2 changed files map to changed impact.

Before / after behavior

  • observed — Modified behavior in crates/tinymemory-api/src/safety/README.md: Added documentation of four inherited detection limitations: missed grouped IBANs, duplicate counts from overlapping phone rules, incomplete card matching near boundaries or adjacent CVVs, and international phone matching that counts separators rather than normalized digits.
  • observed — Modified behavior in crates/tinymemory-api/src/safety/rules.rs: Replaced the comment describing an E.164-like number with a comment describing the legacy phone-like pattern, noting that its repetition counts separators and normalized digit bounds remain for follow-up #263. The regex and rule behavior are unchanged.


Pre-merge checks | Passed 4 | Failed 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: documentation that clarifies inherited local safety matcher limitations.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)


  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR



  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

A rabbit reads the safety page
Four limits hop onto the stage
The phone rule’s comment now is clear
Its pattern stays as it was here
No regex changed along the way
The rabbit thumps a brief hooray

Comment @coderabbitai help to get the list of available commands.

@senamakel senamakel self-assigned this Oct 11, 2026
@senamakel
senamakel merged commit 29c268c into main Oct 11, 2026
35 checks passed
@tinysweeper

tinysweeper Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

Tiny Sweeper review

⏳ Reviewing 3e671af912b4 now. The last completed report, when available, remains below until this pass finishes.

Previous completed report

Tiny Sweeper review

Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: 3e671af912b4
Updated: 2026-10-12T00:01:56Z

Review snapshot

Change surface Files Review signal Count
Production 1 Active findings 0
Tests 0 Noted findings 0
Documentation 1 Resolved findings 0
Configuration 0 Pending checks/questions 0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

How this fits together

flowchart LR
  n0["build_rules<br/>changed"]:::changed
  n1["Rule"]:::impacted
  n2["PiiCategory"]:::impacted
  n3["compile_builtin"]:::impacted
  n4["keyword_rule"]:::impacted
  n5["pattern_rule"]:::impacted
  n6["rules"]:::impacted
  n0 -->|uses| n1
  n1 -->|uses| n2
  n4 -->|uses| n1
  n4 -->|uses| n2
  n4 -->|calls| n3
  n5 -->|uses| n1
  n5 -->|uses| n2
  n5 -->|calls| n3
  n6 -->|uses| n1
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Loading
Agent review details

critique

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `d1b06334faf7`), so retrieved context may be out of date._

security

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: The change is a comment-only edit to `crates/tinymemory-api/src/safety/rules.rs`: the E.164 pattern comment is reworded to describe the legacy separator-counting behaviour and to reference a follow-up issue. No code, regex, or logic changed, so there is nothing new to review for correctness or security; the comment also matches the pattern it annotates. 1 file was not security-reviewed: crates/tinymemory-api/src/safety/README.md (prose or tabular data). _The code index is behind this pull request (indexed at `d1b06334faf7`), so retrieved context may be out of date._

tests

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: The change is comment-only: the README gains a paragraph recording inherited limitations and issue links, and the E.164-ish regex gains a two-line comment about its separator-counting behaviour. No behaviour changed — the regex string, predicates and rule ordering are byte-identical — so no test could fail on a regression here and none is needed. The README's claims (grouped IBANs missed, overlapping phone counts, card/CVV boundaries, separator-counted repetition) match the unchanged patterns in `build_rules`, including the `[\d\s\-]{6,16}` span the new comment describes, so the notes are not a claim being passed off as verified behaviour. _The code index is behind this pull request (indexed at `d1b06334faf7`), so retrieved context may be out of date._

commits

  • Conclusion: Neutral
  • Scope reviewed: all assigned evidence
  • Lane summary: Nothing sensitive found in what this pull request commits.

description

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: This is a documentation-only change: it adds a known-limitations paragraph to the safety README and rewrites the comment above the international phone regex to describe its separator-inclusive quantifier. No detection or redaction behavior changes, and the new comment matches the pattern it describes (`\+\d(?:[\d\s\-]{6,16}\d)` counts separators); the README's claims about the international rule's bounds are consistent with the regex. I found nothing reportable. _The code index is behind this pull request (indexed at `d1b06334faf7`), so retrieved context may be out of date._
Evidence and run details
  • Models: ladder/vectors-oai3, deepseek-v4.1-flash
  • Spend: $0.000156
  • Tokens: 104099 input · 1895 output · 29952 cached · 119 embedding
Head State Pass summary
3e671af912b4 ready for maintainer review 0 active finding(s), 0 resolved finding(s) (at 2026-10-12T00:01:56Z)

tinysweeper 0.1.2

@tinysweeper tinysweeper Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tinysweeper found nothing blocking. Approving.

             $0.0002 · 104,099 in / 1,895 out · 29,952 cached (29%) · ladder/vectors-oai3, deepseek-v4.1-flash · 119 embedded
critique:    $0.0000 · 45,887 in  / 517 out   · 7,552 cached (16%)  · deepseek-v4.1-flash
security:    $0.0000 · 14,337 in  / 96 out    · 2,944 cached (21%)  · deepseek-v4.1-flash
tests:       $0.0000 · 30,489 in  / 328 out   · 15,360 cached (50%) · deepseek-v4.1-flash
description: $0.0000 · 11,454 in  / 297 out   · 4,096 cached (36%)  · deepseek-v4.1-flash

@tinysweeper tinysweeper Bot added the priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect. label Oct 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant