# PIIHunter Launches to Scan PostgreSQL and Jira for Exposed PII

> The new PIIHunter security tool scans PostgreSQL databases and Jira projects to discover exposed Personally Identifiable Information using multiple layers.

- Canonical URL: https://coreiten.com/en/article/piihunter-security-tool-scans-postgresql-and-jira-for-pii
- Language: en
- Section: Projects
- Author: Sami
- Published: 2026-10-19T00:02:41+03:00
- Modified: 2026-10-19T00:02:41+03:00
- Publisher: CoreITen (https://coreiten.com)
- Keywords: PIIHunter, PostgreSQL, Jira, Microsoft Presidio, spaCy

## Summary

Released on October 16, PIIHunter is a new security tool designed to help application security and privacy teams discover accidental exposure of personally identifiable information.

- PIIHunter combines deterministic regex patterns, Microsoft Presidio or spaCy NER/ML models, and optional self-hosted LLMs for its detection layers.
- The tool requires downloading the approximately 800MB spaCy NER model and setting up a read-only database role to scan PostgreSQL.
- Jira scan results are automatically saved to a dated JSON or CSV file on every run, supporting historical lookback windows and real-time webhooks.
- Smart exception filters in the software suppress expected content like company email addresses and @mentions to reduce false positives.

**Why it matters:** This tool gives internal security teams a modular, privacy-focused open solution to proactively catch data leaks in databases and issue-tracking software.

---

Application Security and Privacy teams have a new internal tool for discovering Personally Identifiable Information (PII). Released on October 16, the PIIHunter security tool scans PostgreSQL databases and Jira projects to detect accidental data exposure using multiple layers of analysis.

### Detection Methods and Features

PIIHunter combines three detection layers for comprehensive coverage. It uses deterministic regex patterns to find emails, phone numbers, Social Security Numbers, and credit cards. For entity recognition, such as names, locations, and dates, it relies on NER/ML models like Microsoft Presidio or spaCy. Additionally, teams can use optional self-hosted Large Language Models (LLMs) to classify ambiguous free-text data.

The tool includes smart exception filters to suppress expected content, such as `@mentions` and company email addresses. It analyzes representative data samples to minimize performance impact through intelligent sampling. Every scan is logged with its configuration, timestamps, and model versions to maintain a comprehensive audit trail, while privacy-safe logging automatically redacts PII in all logs and stored samples. Jira scan results are automatically saved to a dated JSON or CSV file on every run.

### Database Schema Scan

To scan a PostgreSQL database for PII across columns, users must first set up the environment and download the approximately 800MB spaCy NER model.

```bash
# Clone the repository
cd PIIHunter

# Create virtual environment
python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Download spaCy NER model (~800MB)
python -m spacy download en_core_web_lg
```

Next, create a read-only role in the database.

```sql
CREATE ROLE pii_scanner_readonly WITH LOGIN PASSWORD 'your_secure_password';
GRANT CONNECT ON DATABASE your_database TO pii_scanner_readonly;
GRANT USAGE ON SCHEMA public, app_data TO pii_scanner_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public, app_data TO pii_scanner_readonly;
```

Configure the environment variables.

```bash
cp .env.example .env
# Fill in DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD
```

The tool creates a `security_pii` schema to store scan results. Run the following commands to discover columns, run the detection, and view reports.

```bash
# Preview candidate columns (no data read)
python -m pii_scanner.cli discover

# Run PII detection
python -m pii_scanner.cli scan --sample-size 1000

# View results
python -m pii_scanner.cli report
```

To test the database connection, use this command.

```bash
python -m pii_scanner.cli test-connection
```

### Jira Scan Integration

PIIHunter can scan Jira issues and comments for accidental PII exposure by polling for activity in the last specified hours, which requires no server. Database setup is not required for this feature, but the base installation is necessary.

```bash
cd PIIHunter
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python -m spacy download en_core_web_lg
```

To configure Jira access:

1. Go to `https://id.atlassian.com`, navigate to **Security**, and select **API tokens**.
2. Click **Create API token**, give it a name, and copy the token.

Add the credentials to the configuration file.

```ini
JIRA_URL=https://yourcompany.atlassian.net
JIRA_EMAIL=you@yourcompany.com
JIRA_API_TOKEN=your_api_token_here

# Optional — leave empty to scan all projects
# JIRA_PROJECT_KEYS=ENG,OPS,SUPPORT

# Emails from these domains will NOT be flagged as PII
COMPANY_EMAIL_DOMAINS=yourcompany.com
```

The tool verifies credentials, lists accessible projects, and fetches a sample of recent issues. If it fails, users should check their API token and ensure the email matches the account.

```text
Testing connection to https://yourcompany.atlassian.net...

  Auth          ✓  logged in as Jane Smith (jane@yourcompany.com)
  Projects      ✓  3 accessible: ENG, OPS, SUPPORT
  Project ENG   ✓  accessible

  Recent issues (no time filter):
    ENG-101  Fix login timeout on mobile
    ENG-100  Update password policy
```

Run the scan with a custom lookback window.

```bash
# Scan last 24 hours
python -m pii_scanner.cli jira scan

# Custom lookback window
python -m pii_scanner.cli jira scan --hours 48
```

### Real-Time Jira Webhooks

For real-time scanning, PIIHunter can start an HTTP server that receives Jira events and scans them instantly. This requires a publicly reachable endpoint and the base installation.

```ini
# Secret used to verify requests genuinely come from Jira
JIRA_WEBHOOK_SECRET=your_webhook_secret
JIRA_WEBHOOK_PORT=8080
```

Start the webhook server.

```bash
python -m pii_scanner.cli jira webhook

# Custom port
python -m pii_scanner.cli jira webhook --port 9090
```

Configure the webhook in Jira:

1. In Jira, go to **Project Settings**, select **Webhooks**, and click **Create webhook**.
2. Set the URL to `http://yourserver:8080/webhook`.
3. Under **Events**, select `Issue → created` and `Comment → created`.
4. Set the secret to match the webhook secret in the configuration file and save.

Jira will now send a POST request to the server for every new issue and comment, allowing the scanner to process each one immediately.

### Deployment and Security Guidelines

PIIHunter is designed strictly for internal use within a secure, controlled environment. It operates with a security-first design, utilizing read-only database access, making no external API calls, and ensuring minimal PII retention. For production webhook setups, the developers warn against exposing uvicorn directly to the internet.

## Sources

- [kitploit.com](https://kitploit.com/en/tools/github/owasp/piihunter)

## Related topics

- [Jira](https://coreiten.com/en/topic/jira)