v1.2.2 finally shipped Sensitive Data Warning. It took four versions to get right.

Six weeks ago I started adding a warning that fires before the user sends a prompt
containing email, phone, API key, address, or financial number to a third-party AI.

Version 1 only checked emails. A user pasted a phone number the next day and asked
why the extension did not flinch. Fair.

Version 2 added phones with a US-shape regex. A user pasted [phone].
It matched the digit cluster and missed the international prefix. Also fair.

Version 3 added API keys, addresses, and credit-card-shape numbers. The credit card
case was the one I was dreading. I used a loose regex first. False positives on every
random 16-digit order ID in every admin panel a user pasted. Killed it.

Version 4 (v1.2.2) keeps the loose shape regex for the prefilter, then runs Luhn on
the digit-only string. It also normalizes each finding's sample to the first 80 chars
and strips internal whitespace. Five detector kinds now: email, phone, apiKey,
address, financialNumber.

The bug I am still chewing on: the address detector is English-only. A Berlin user
sent me a screenshot where the regex missed Hauptstrasse 12, 10827 Berlin because
the street suffix list has Street / Avenue / Road / Boulevard / Lane / Drive / Court
/ Way / Place and nothing else. I am not going to ship a multilingual street database
in a Chrome extension. The honest answer is probably "warn with low confidence for
non-English shapes and let the user decide." That is a feature request, not a fix.

Worth noting: I split this work off from the prompt-send policy on purpose. The send
policy decides whether to send. The sensitive-data check decides whether to ask
first. Conflating them made the first two versions incoherent. Putting them in
separate modules (sendPolicy vs sensitiveData) was the actual win in week 3.

If you are building something similar, my checklist now is:

• regex prefilter + structural validation (Luhn, checksum) for numbers
• per-finding sample is bounded, never the raw input
• detectors live in their own module so the test file is tiny and readable
• international cases get a separate code path, not a bigger regex

Five detector types, one Luhn check, one 80-char sample cap, three weeks of false
positives. AI Buddy's Sensitive Data Warning is the feature I am least proud of and
most glad to have shipped.

Anyone else hit the "loose regex false-positive" trap on credit cards? Curious what
shapes other people settled on.