Find personally identifiable information in a text blob: emails, phone numbers, credit cards (Luhn-validated), IBANs (mod-97 validated), IPv4/IPv6 addresses, US SSNs and JWTs. Returns every match with its type and character offsets, plus per-type counts. Validated — not just pattern-matched — to keep false positives low. Fully offline.

Check up to 50 CVE IDs against CISA's Known Exploited Vulnerabilities (KEV) catalog. Returns membership, vendor/product, exploitation evidence, ransomware-use status and remediation guidance from CC0 data. Not listed does not mean safe or unexploited. Federal due dates are not global deadlines. Refreshed hourly; stale snapshots are explicitly flagged.

Return the input text with every detected PII span replaced. `mode` controls the replacement: "label" (default) → `[EMAIL]`; "mask" → the value covered with a mask character; "hash" → `[EMAIL:1a2b3c4d]`, a stable per-value fingerprint so equal values stay linkable without exposing them. Same validated detectors as `/detect`. Fully offline.

Scan source code or configuration text for hardcoded secrets: AWS access keys, GitHub/Slack/Google tokens, Stripe and OpenAI keys, PEM private-key blocks, JWTs and high-entropy secret assignments. Placeholder values are filtered out. Each finding gives the rule, a severity (critical/high/medium/low), line and column, entropy and a masked excerpt. Offline and deterministic.