MediumJavaScriptTypeScript

PII Redaction — Mask Credit Card Numbers Before Logging

JavaScriptSecuritySensitive Data Exposure

A payment service logs the full request message for debugging, including whatever text was submitted.

The bug: log files routinely have weaker access controls than the production database, get shipped to third-party log aggregators, and are kept far longer than necessary — logging a full credit card number is a direct path to a compliance violation and a data breach.

Your task: fix solve(message) so any 16-digit credit card number in the message (with or without spaces/dashes grouping the digits in 4s) is replaced with **** **** **** followed by only the last 4 digits. Text with no card number is returned unchanged.

Sample tests

Test #1Space-separated card number
Input: ["Charged card 4111 1111 1111 1234"]
Output: "Charged card **** **** **** 1234"
Test #2Dash-separated card number
Input: ["Card: 4111-1111-1111-1234"]
Output: "Card: **** **** **** 1234"
Test #3No card number — unchanged
Input: ["No sensitive data here"]
Output: "No sensitive data here"