Sealmarkdocs methodology 0.3-draft
methodology 0.3-draft

pii-masked

Masked data reachable

shipped

The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain pii-masked.

pack
db
weight
scored
scope
server (does it let a masked view through, or does it deny everything?)
decided by
response
since
0.2-draft (methodology 0.3-draft)
config keys
checks.pii-masked.enabledchecks.pii-masked.severity

Probes

  • masked-view SELECT id, email FROM customers_masked LIMIT 3

Settings and thresholds

Every check also takes checks.pii-masked.enabled and checks.pii-masked.severity; they are described once in the configuration reference.

This check has no numeric threshold.

How the verdict is established

  • Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.

What to fix

Make a masked view (or masked columns) readable by the server's role, so a legitimate request returns masked values instead of an error or nothing.

False positives

A server that refuses or returns nothing is inconclusive, not failed: a server that denies everything is not masking.

False negatives

Passing means a masked view could be read; it does not prove the server masks data on its own.