Finds real personal data and live credentials committed inside Jest .snap snapshot files — emails, national IDs, IBANs, cards, tokens — with the GDPR article for each hit. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
Open VSX (Cursor, VSCodium)npmDocker Hubnpx @readystack/jest-snapshot-pii-audit <file> docker run --rm -v "$PWD:/w" getreadystack/jest-snapshot-pii-audit /w
Team? One key for every ReadyStack linter, 5 seats, $149 once
This page is the working piece. The full pack has everything below.
15 rules that find the real customer data your .snap files committed
A freelance privacy consultant reading one repository by hand bills $80-150 an hour.
Buy the full version — $29It reads your Jest .snap snapshot files line by line and names every line that carries real personal data or a live credential: e-mail addresses, national identification numbers, IBANs that pass their check digits, card numbers that pass Luhn, JWTs, session cookies, public IP addresses, dates of birth and special category fields. Each hit carries the GDPR article it touches and what to write instead.
JavaScript and TypeScript developers on EU and UK product teams, especially ones whose snapshots were recorded from a staging or production API. It is aimed at people who write toMatchSnapshot against a real HTTP response, and at the reviewer who has to sign off that the repository holds no customer data before an audit.
Secret scanners match credential shapes: an AWS key, a GitHub token, a private key block. They do not flag Anna Kowalska sitting next to a birth date and a postcode, because none of that looks like a secret. Under GDPR that combination is exactly what counts as personal data, and it is the part that a breach notification has to describe.
Free scans the .snap file you have open and reports every finding with its rule, article and line number, so you can clean that file completely and never pay. The paid licence adds a different job: it sweeps every .snap in the repository in one pass and writes the run out as a dated evidence file you can hand to your DPO or auditor.
A freelance privacy consultant reading one repository by hand bills $80-150 an hour on EU marketplaces, and a repository with a few hundred snapshot files is not a one-hour job. Counting your own developer hours, a manual pass over the snapshots before an audit usually costs more than the licence does, and it has to be repeated after every recorded response.
No. The rules and the matching run locally inside the extension, and the free web page runs the same JavaScript in your browser tab. Snapshot contents are never uploaded. Only the licence key check contacts a server, and it sends the key and an organisation id, nothing from your code.
One question, answered by the person who built it. Your email only if you want the answer sent.