Shaunebu.Security.DataMasking 1.0.0

Shaunebu.Security.DataMasking

DataMasking is a .NET library for masking sensitive data in objects, JSON, and strings. It supports profiles, custom masking rules, logging, reports, and automatic [Sensitive] attribute detection, making it ideal for applications that handle personal or confidential information.

Features

• Mask strings by type: Email, Name, Phone, Credit Card, SSN, Token, and more

• Fluent API for individual string masking

• Mask C# objects decorated with [Sensitive] attributes

• Mask JSON strings or objects using Newtonsoft.Json or System.Text.Json

• Support for nested objects and arrays

• Logging callbacks and custom logger interface

• Customizable masking profiles loaded from appsettings.json

• Programmatic profile registration for code-based configuration

• Automatic application of custom rules per profile

• Masking reports to track which fields were masked

Installation

dotnet add package Shaunebu.Security.DataMasking

Or via NuGet Package Manager:

Install-Package Shaunebu.Security.DataMasking

Usage

1️⃣ Setup and Configuration

using Microsoft.Extensions.Configuration;
using Shaunebu.Security.DataMasking;

// Load configuration
var config = new ConfigurationBuilder()
    .AddJsonFile("appsettings.json")
    .Build();

// Load profiles and custom rules
DataMaskerConfiguration.LoadProfilesFromConfiguration(config.GetSection("DataMasking"));

Option B: Programmatic Configuration

using Shaunebu.Security.DataMasking;
using Shaunebu.Security.DataMasking.Core;
using Shaunebu.Security.DataMasking.Enums;

// Create and register profiles programmatically
var strictProfile = new MaskingProfile { Level = MaskingLevel.Strict }
    .AddTokenRule("Password", 0, 0)                    // Hide completely
    .AddTokenRule("SessionToken", 3, 3)                // Show first 3 and last 3
    .AddTokenRule("ApiSecret", 4, 4)                   // Show first 4 and last 4
    .AddEmailRule("PersonalEmail", MaskingLevel.Strict) // Strict email masking
    .AddCustomRule("SecurityPin", s => "****");        // Always show as 4 asterisks

DataMasker.RegisterProfile("ProgrammaticStrict", strictProfile);

// Extension methods for fluent configuration
public static class MaskingProfileExtensions
{
    public static MaskingProfile AddCustomRule(this MaskingProfile profile, string propertyName, 
        Func<string, string> maskingFunction)
    {
        profile.CustomRules[propertyName] = maskingFunction;
        return profile;
    }

    public static MaskingProfile AddTokenRule(this MaskingProfile profile, string propertyName, 
        int visibleStart = 2, int visibleEnd = 2, char maskChar = '*')
    {
        profile.CustomRules[propertyName] = s => DataMasker.MaskToken(s, visibleStart, visibleEnd, maskChar);
        return profile;
    }

    public static MaskingProfile AddEmailRule(this MaskingProfile profile, string propertyName, 
        MaskingLevel level = MaskingLevel.Medium)
    {
        profile.CustomRules[propertyName] = s => DataMasker.MaskEmail(s, level);
        return profile;
    }
}

2️⃣ Define a model with [Sensitive] attributes

public class UserModel
{
    [Sensitive("Email")] public string Email { get; set; } = "";
    [Sensitive("Name")] public string Name { get; set; } = "";
    [Sensitive("Phone")] public string Phone { get; set; } = "";
    [Sensitive("CreditCard")] public string CardNumber { get; set; } = "";
    [Sensitive("SSN")] public string SSN { get; set; } = "";
    public string Password { get; set; } = ""; // Will use custom rules from profile
    public string SessionToken { get; set; } = ""; // Will use custom rules from profile
    public string Notes { get; set; } = "Not sensitive";
}

3️⃣ Mask an object and get a report

var user = new UserModel
{
    Email = "johndoe@example.com",
    Name = "John Doe",
    Phone = "+1-555-123-4567",
    CardNumber = "4111111111111111",
    SSN = "123-45-6789",
    Notes = "Not sensitive"
};

var profile = DataMasker.GetProfile("StrictProfile");
var masker = new DataMasker(profile.Level)
    .OnMask((original, masked, type) =>
    {
        Console.WriteLine($"Callback -> {type}: {original} -> {masked}");
    });

// Automatically applies profile custom rules
var report = DataMasker.MaskObjectWithReport(user, masker);

Console.WriteLine($"Fields masked: {report.FieldsMasked}");
Console.WriteLine("Masked properties: " + string.Join(", ", report.MaskedProperties));

4️⃣ Mask JSON manually

string json = @"{
    ""Email"": ""johndoe@example.com"",
    ""Name"": ""John Doe"",
    ""Phone"": ""+1-555-123-4567"",
    ""CardNumber"": ""4111111111111111"",
    ""SSN"": ""123-45-6789"",
    ""Notes"": ""Not sensitive""
}";

var maskedJson = DataMasker.MaskJson(json, new[] { "Email", "Name", "Phone", "CardNumber", "SSN" });
Console.WriteLine(maskedJson);

5️⃣ Mask JSON using System.Text.Json converter

var options = new JsonSerializerOptions { WriteIndented = true };
options.Converters.Add(new SensitivePropertyConverter<UserModel>(masker));

var jsonMasked = JsonSerializer.Serialize(user, options);
Console.WriteLine(jsonMasked);

6️⃣ Mask individual strings

string email = "someone@example.com";

Console.WriteLine(email.MaskEmail(MaskingLevel.Strict));
Console.WriteLine("Jonathan".MaskName());
Console.WriteLine("+44-555-987-6543".MaskPhone());
Console.WriteLine("abc12345xyz".MaskToken(3, 3));
Console.WriteLine("5555666677778888".MaskCreditCard());
Console.WriteLine("987-65-4321".MaskSSN());

Profiles & Custom Rules

Profiles can be defined in appsettings.json:

{
  "DataMasking": {
    "Profiles": {
      "StrictProfile": {
        "Level": "Strict",
        "CustomRules": {
          "Password": "Token",
          "SessionToken": "Token",
          "BankAccount": "Token",
          "RoutingNumber": "Token"
        }
      },
      "MediumProfile": {
        "Level": "Medium",
        "CustomRules": {
          "Password": "Token",
          "SessionToken": "Token"
        }
      }
    }
  }
}

• Level defines default masking level for standard types

• CustomRules automatically apply for any property with matching names

Programmatic Profile Registration

For more flexibility and compile-time safety, you can create profiles programmatically:

// Create profiles with fluent API
var strictProfile = new MaskingProfile { Level = MaskingLevel.Strict }
    .AddTokenRule("Password", 0, 0)                    // Complete masking
    .AddTokenRule("ApiKey", 4, 4)                      // Show first/last 4
    .AddTokenRule("SessionToken", 3, 3)                // Show first/last 3
    .AddEmailRule("RecoveryEmail", MaskingLevel.Strict) // Strict email
    .AddCustomRule("SecurityCode", s => "***")         // Fixed masking
    .AddCustomRule("InternalId", s => $"ID-{s.Length}-MASKED"); // Custom logic

// Register the profile
DataMasker.RegisterProfile("CustomStrict", strictProfile);

// Use the profile
var profile = DataMasker.GetProfile("CustomStrict");
var report = DataMasker.MaskObjectWithReport(user, masker, profile);

• Level defines default masking level for standard types

• CustomRules automatically apply for any property with matching names

• Programmatic profiles take precedence and can be combined with JSON configuration

Logging

You can register a global logger:

DataMasker.UseLogger(new MyCustomLogger());

public class MyCustomLogger : IMaskingLogger
{
    public void OnMasked(string original, string masked, string type)
    {
        Console.WriteLine($"[Logger] {type}: {original} -> {masked}");
    }
}

• Optional callback per DataMasker instance with .OnMask(...)

Advanced

• Automatically masks nested objects and arrays

• Supports dynamic runtime application of custom rules from profiles

• Use MaskObjectWithReport to track which properties were masked

License

MIT License © Jorge Perales Diaz