Anonymizer

Preserve the content; hide the personal bits. Default to --level low, not all-text masking. The level changes detection scope, not pixel opacity. Every selected image pixel is still irreversibly replaced.

Contract

• Local inference: OpenAI openai/privacy-filter for contextual PII, Gitleaks for credentials, Tesseract hOCR for image text/character locations. First use downloads weights; input is not sent for inference.
• Preserve original files, useful prose, headings, labels, public documentation URLs, layout and surrounding image pixels. Default low does not treat a whole project panel as private merely because it contains a name.
• Always scan credentials at every level. Never weaken secret masking because the user selected low.
• Replace only detected values/spans, not surrounding labels (Email:, API key:, password is), where detector boundaries allow it. No reverse mapping is stored.
• No perfect-anonymity/compliance claim. Model/OCR can miss or over-identify details; all results require review. A low-coverage result is not safe for every audience.
• Keep originals, raw OCR, literal lists, and real screenshots out of public examples, logs, Git and memory. Use neutral filenames and reports containing counts, not raw values.

Phases

1. Pick coverage

Low — default, useful sharing. Mask high-confidence personal names, contacts, private addresses, account identifiers, local-path usernames and secrets. Keep surrounding text, ordinary dates, public URLs and general project/company context. Contextual detector errors remain possible.