Finding Card Numbers Hiding in Your Postgres Columns or Jira Tickets: Nandan Gupta and Nayan Goel at Global AppSec USA 2026
OWASP PIIHunter scans PostgreSQL columns, Jira ticket comments and free-text notes fields for personally identifiable information that engineers rarely think to look for.
Personally identifiable information (PII) includes Social Security numbers, card numbers, phone numbers and names. It often ends up in places no data inventory covers, such as a customer's card number pasted into a support ticket.
PIIHunter detects it in three layers. Regular expressions with a Luhn checksum validate card numbers, Microsoft Presidio's machine learning recognizes named entities, and an optional self-hosted LLM handles ambiguous text.
No data leaves the organization's perimeter during a scan.
In their Global AppSec USA 2026 demo lab, "OWASP PIIHunter: AI-Powered PII Discovery in Databases and Jira", on Thursday, November 5 at 1:15 p.m. in Golden Gate, Nandan Gupta and Nayan Goel scan a real database alongside a live Jira instance.
Speakers:
- Nandan Gupta, Principal Application Security Engineer
- Nayan Goel, Principal Application Security Engineer
The demo surfaces SSNs, phone numbers and names from the database. It also catches a credit card number posted in a Jira ticket in real time.
The PIIHunter repository shows how the scan stays contained. It connects to PostgreSQL through a read-only role, samples rows rather than reading every one, and stores results in a separate schema with redacted samples.
Jira scanning works by polling or through real-time webhooks, which are checked with HMAC-SHA256 signatures. Every scan is written to an audit log.
Nandan Gupta is a Principal Application Security Engineer at a fintech company, working on secure design, code review and threat modeling. He has presented at Black Hat Europe, the DEF CON AppSec Village and BSidesSF.
He wrote PIIHunter's Jira integration, added in April 2026.
Nayan Goel is a Principal Application Security Engineer at a fintech company and an AI security researcher, with more than seven years in application security. He wrote PIIHunter's first version in December 2025, then hardened it for its move to OWASP in October 2026.
He created PromptInjector, a tool for testing AI systems for prompt injection that works with OpenAI, Anthropic or Ollama models. He contributes to the OWASP Agentic Security Guidelines.
The two co-wrote GraphQL Security Tester, a Burp Suite Professional extension in PortSwigger's BApp Store. It uses Burp AI to generate GraphQL queries that test for SQL injection, authorization bypass, denial of service and information disclosure.
To go deeper on the topic, start here:
- OWASP PIIHunter source code
- Microsoft Presidio documentation
- GraphQL Security Tester by Nayan Goel and Nandan Gupta (BApp Store)
- PromptInjector by Nayan Goel
Privacy and security teams that have mapped PII in their main databases, but never in tickets or notes fields, will see what they may be missing.
Has anyone at your company ever searched your Jira tickets for card numbers or Social Security numbers?
2 points · 1 comment
Mentions
Finding Card Numbers Hiding in Your Postgres Columns or Jira Tickets: Nandan Gupta and Nayan Goel at Global AppSec USA 2026 OWASP PIIHunter scans PostgreSQL columns, Jira ticket comments and free-text notes fields for personally identifiable information that engineers rarely think to look for. Personally identifiable information (PII) includes Social Security numbers, card numbers, phone numbers and names. It often ends up in places no data inventory covers, such as a customer's card number pasted into a support ticket. PIIHunter detects it in three layers. Regular expressions with a Luhn checksum validate card numbers, Microsoft Presidio's machine learning recognizes named entities, and an optional self-hosted LLM handles ambiguous text. No data leaves the organization's perimeter during a scan. In their Global AppSec USA 2026 demo lab, "OWASP PIIHunter: AI-Powered PII Discovery in Databases and Jira", on Thursday, November 5 at 1:15 p.m. in Golden Gate, Nandan Gupta and Nayan Goel scan a real database alongside a live Jira instance. Speakers: - Nandan Gupta, Principal Application Security Engineer - Nayan Goel, Principal Application Security Engineer The demo surfaces SSNs, phone numbers and names from the database. It also catches a credit card number posted in a Jira ticket in real time. The PIIHunter repository shows how the scan stays contained. It connects to PostgreSQL through a read-only role, samples rows rather than reading every one, and stores results in a separate schema with redacted samples. Jira scanning works by polling or through real-time webhooks, which are checked with HMAC-SHA256 signatures. Every scan is written to an audit log. Nandan Gupta is a Principal Application Security Engineer at a fintech company, working on secure design, code review and threat modeling. He has presented at Black Hat Europe, the DEF CON AppSec Village and BSidesSF. He wrote PIIHunter's Jira integration, added in April 2026. Nayan Goel is a Principal Application Security Engineer at a fintech company and an AI security researcher, with more than seven years in application security. He wrote PIIHunter's first version in December 2025, then hardened it for its move to OWASP in October 2026. He created PromptInjector, a tool for testing AI systems for prompt injection that works with OpenAI, Anthropic or Ollama models. He contributes to the OWASP Agentic Security Guidelines. The two co-wrote GraphQL Security Tester, a Burp Suite Professional extension in PortSwigger's BApp Store. It uses Burp AI to generate GraphQL queries that test for SQL injection, authorization bypass, denial of service and information disclosure. To go deeper on the topic, start here: - OWASP PIIHunter source code - Microsoft Presidio documentation - GraphQL Security Tester by Nayan Goel and Nandan Gupta (BApp Store) - PromptInjector by Nayan Goel Privacy and security teams that have mapped PII in their main databases, but never in tickets or notes fields, will see what they may be missing. Has anyone at your company ever searched your Jira tickets for card numbers or Social Security numbers?