Jest Snapshot PII Audit

Finds real personal data and live credentials committed inside Jest .snap snapshot files — emails, national IDs, IBANs, cards, tokens — with the GDPR article for each hit. Runs entirely in your browser — nothing is uploaded.

Same engine as the VS Code extension, byte for byte.

Install free

Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.

Open VSX (Cursor, VSCodium)npmDocker Hub
npx @readystack/jest-snapshot-pii-audit <file>
docker run --rm -v "$PWD:/w" getreadystack/jest-snapshot-pii-audit /w

Team? One key for every ReadyStack linter, 5 seats, $149 once

Get one email when this rule changes
We watch the regulation and vendor sources behind Jest Snapshot PII Audit every day. When a rule changes, you get a single email with what changed and the updated check. No newsletter.

Get the complete version $29

This page is the working piece. The full pack has everything below.

15 rules that find the real customer data your .snap files committed

A freelance privacy consultant reading one repository by hand bills $80-150 an hour.

Buy the full version — $29

Questions people ask

What does Jest Snapshot PII Audit actually do?

It reads your Jest .snap snapshot files line by line and names every line that carries real personal data or a live credential: e-mail addresses, national identification numbers, IBANs that pass their check digits, card numbers that pass Luhn, JWTs, session cookies, public IP addresses, dates of birth and special category fields. Each hit carries the GDPR article it touches and what to write instead.

Who is this for?

JavaScript and TypeScript developers on EU and UK product teams, especially ones whose snapshots were recorded from a staging or production API. It is aimed at people who write toMatchSnapshot against a real HTTP response, and at the reviewer who has to sign off that the repository holds no customer data before an audit.

Why will a normal secret scanner not catch this?

Secret scanners match credential shapes: an AWS key, a GitHub token, a private key block. They do not flag Anna Kowalska sitting next to a birth date and a postcode, because none of that looks like a secret. Under GDPR that combination is exactly what counts as personal data, and it is the part that a breach notification has to describe.

What is free and what does the paid version add?

Free scans the .snap file you have open and reports every finding with its rule, article and line number, so you can clean that file completely and never pay. The paid licence adds a different job: it sweeps every .snap in the repository in one pass and writes the run out as a dated evidence file you can hand to your DPO or auditor.

What would it cost to have a person do this?

A freelance privacy consultant reading one repository by hand bills $80-150 an hour on EU marketplaces, and a repository with a few hundred snapshot files is not a one-hour job. Counting your own developer hours, a manual pass over the snapshots before an audit usually costs more than the licence does, and it has to be repeated after every recorded response.

Does anything leave my machine?

No. The rules and the matching run locally inside the extension, and the free web page runs the same JavaScript in your browser tab. Snapshot contents are never uploaded. Only the licence key check contacts a server, and it sends the key and an organisation id, nothing from your code.

Ask about this tool

One question, answered by the person who built it. Your email only if you want the answer sent.

ENDEJAESPT

Find a tool