Masking before model calls | kanman documentation

kanman reads tickets, wiki pages, CI logs and chat messages to do its work, and these often contain more than the work needs: a customer’s email address, a caller’s phone number, a password someone pasted into a ticket. Masking makes sure none of that reaches a language model. Before every model call, kanman replaces such values with placeholders like [EMAIL_1] or [PHONE_2]. The model works with the placeholders; the real values stay with kanman.

Masking is always on, for every workspace, in kanman Cloud and on your own runners. There is nothing to switch on.

What is always masked

What	Examples
Secrets and tokens	API keys, access tokens, private keys, passwords in URLs
Email addresses	`[email protected]`
Phone numbers and call records	`+49 30 1234567`, `030/12345678`, numbers in call detail records
IBANs	checked with the IBAN checksum
Card numbers	checked with the card number checksum
IP addresses	IPv4 and IPv6
Postal addresses	street and house number, postcode and city
Customer and contract numbers	labelled numbers such as “Customer ID: K-482913”
Names of people outside your workspace	for example the reporter of a ticket who is not a member; your members’ names stay

kanman takes care to mask only what it should: version numbers, commit hashes, dates, times, line numbers and timestamps are left as they are, so the model still understands logs and changes.

Your own patterns

Every company has numbers only it knows, such as contract, case or ticket numbers. Add them as patterns:

Open Workspace settings > Model access (/<workspace>/settings/models).
Find the card Masking before model calls.
Under Your own patterns, select Add pattern, give it a label (for example “Contract number”) and a regular expression (for example VT-\d{4}-\d{5}).

A pattern is checked as soon as you leave the field. kanman tells you if it is not a valid regular expression or if it could slow down the check, and saves it only when it is fine. You can add up to 20 patterns. Only owners and admins can change them; every change is recorded in the audit log.

Values matching your patterns get placeholders named after the label, for example [CONTRACT_NUMBER_1].

Where the real values come back

The model never sees the real values. Where kanman has to act on one, for example to reply to an email address or to mention a customer number in a ticket comment, kanman puts the value back itself, at the moment it acts. Secrets, IBANs, card numbers and postal addresses are never put back.

What is not masked

The code in your repositories is not masked. kanman’s helpers read and change your code as it is, so a placeholder can never end up in your code. To keep secrets out of your repositories, kanman checks every change for credentials before it pushes it.

Pages with passwords

Some wiki pages exist to hand out credentials, for example a page listing test accounts and their passwords. Masking the passwords alone would still leave the rest of the page in front of a model. kanman therefore leaves such pages out entirely: it tells the model that the page was left out and why, without any of its content.

The first time kanman comes across such a page, the workspace’s owners and admins get a notification naming the page and the system it is in, so someone can move the credentials to a safe place. kanman notifies once per page.

How much is masked

Every model call records how many values were masked and of which kind, so you can show what masking did for your workspace.