Aula PII Scan -- Pre-Push PII Scanner

Scans the workspace (tracked files) and full git history for known Aula PII terms that must never reach a public remote. Run this before every push.

PII terms live in pii-terms.txt alongside this skill. That file is .gitignored on purpose: the list of terms IS the PII, so it must never be committed. Only the redacted pii-terms.txt.example template is tracked.

On a fresh checkout, create the real list once:

SKILL_DIR="$HOME/.claude/skills/aula-pii-scan"
cp "$SKILL_DIR/pii-terms.txt.example" "$SKILL_DIR/pii-terms.txt"
# then edit pii-terms.txt and replace the placeholders with real terms

Procedure

Step 1: Run the scan script

SKILL_DIR="$HOME/.claude/skills/aula-pii-scan"
bash "$SKILL_DIR/scan.sh"

This scans:

1. Workspace -- all git-tracked files (excluding secrets/) for any PII term
2. Git history -- git log -p --all -S <term> for each term across all commits
3. Sensitive files -- checks if .har, .pcap, or secrets/* files were ever committed

Step 2: Report the result

The script exits 0 (PASS) or 1 (FAIL).

If PASS: Report "Aula PII scan passed. Safe to push."

If FAIL: Report each finding with file, line, and matched term. The push must be blocked until all findings are resolved. Typical fixes:

• Move real IDs to secrets/ (gitignored) and use synthetic values in code
• Use git filter-repo --replace-text to scrub history if PII was ever committed
• After history rewrite: git reflog expire --expire=now --all && git gc --aggressive --prune=now

Step 3: Adding new PII terms

If new PII is discovered during development (new profile IDs, names, addresses, etc.), add them to pii-terms.txt (one per line, # for comments) so future scans catch them. Never add real terms to pii-terms.txt.example -- keep that file redacted.