=== DigitalSpace Personal Data Scanner ===
Contributors: digitalspacellc
Tags: gdpr, personal data, privacy, pii, woocommerce
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Finds personal data hiding in users, comments, posts, WooCommerce orders and form entries, and shows you exactly where it sits.

== Description ==

Most WordPress sites hold far more personal data than their owners know: old form submissions, comment emails and IP addresses, IBANs pasted into order notes, drafts nobody deleted, options a plugin filled years ago. Personal Data Scanner finds it, tells you where it is, and links you straight to the record so you can act.

Run one scan and you have a personal data inventory: how many items, of which kinds, in which places.

= What it scans (free) =

* Users and user meta (including WooCommerce billing and shipping fields)
* Comments and comment meta, including spam, trash and WooCommerce order notes
* Posts, pages, custom post types, revisions, drafts and post meta
* WooCommerce orders and customers (HPOS and legacy storage)
* Contact Form 7 submissions stored by Flamingo
* WPForms entries (WPForms Pro stores entries; Lite does not)
* The options table, including serialized and JSON values

= What it detects =

* Email addresses
* Phone numbers (international and common national formats)
* IP addresses (v4 and v6)
* IBANs, validated with the ISO 13616 checksum
* Payment card numbers, validated with the Luhn check and issuer ranges
* National ID numbers: German Steuer-ID, UK National Insurance number, US SSN, Georgian personal number, Italian codice fiscale, Spanish DNI/NIE, Dutch BSN
* Dates of birth in labelled fields or next to a birth keyword
* Names in labelled fields (first name, last name, billing name, comment author)
* Addresses in labelled fields (address, billing/shipping address, street, and common non-English equivalents)
* API keys and secrets: AWS, GitHub, Stripe, OpenAI, Anthropic, Google, Slack, JWTs, and PEM/SSH private keys
* Health keywords and ICD-10 codes for the special-category angle (off by default)

Every finding carries a confidence score so you can focus on the sure things first.

= Privacy by design =

* The plugin stores **masked values only**, for example `j***@example.com` or `DE89**************3000`. It never becomes a second copy of your personal data.
* Nothing leaves your server. The scan runs entirely inside your WordPress install and the plugin makes no outbound requests. There is no telemetry.
* Every action requires the `manage_options` capability and a nonce.

= Working with findings =

* Filter by source, type, confidence and status; search labels and masked values
* Open the record in its own edit screen with one click
* Bulk **Ignore**, which stays in effect for future scans until you reopen it
* Printable on-screen report with a source-by-type matrix and the records holding the most personal data
* WP-CLI: `wp pdscan scan`, `wp pdscan status`, `wp pdscan findings`, `wp pdscan info`

= Pro (coming) =

Delete and anonymize findings (WooCommerce-aware), retention rules, scheduled scans with email summaries, data subject request lookup by email address, PDF and CSV reports, retention policy document, scanning of uploads, logs and backups. Pro buttons are visible in the free version; clicking one lets you leave your email to be notified. That email is stored on your site only.

= Developers =

* Add a data source: implement `PDScan\Scan\SourceInterface` and hook `pdscan/sources`
* Add a detector: implement `PDScan\Scan\DetectorInterface` and hook `pdscan/detectors`
* Add a national ID format in `src/Scan/Detectors/national-ids.php` or via `pdscan/national_ids`
* Add a secret/API key format in `src/Scan/Detectors/secret-keys.php` or via `pdscan/secret_keys`
* Filters: `pdscan/is_pro`, `pdscan/batch_findings`, `pdscan/keep_scans`, `pdscan/health_keywords`, `pdscan/woocommerce/hpos`, `pdscan/posts/skip_types`, `pdscan/options/skip_names`
* The admin screens are a React app. Source is in `assets/src/`, shipped alongside the built `assets/build/index.js` it compiles to. Rebuild with `npm install` then `npm run build` (uses `webpack.config.js` and `@wordpress/scripts`); nothing outside WordPress core's own bundled `@wordpress/*` packages is used.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install it from the Plugins screen.
2. Activate it.
3. Open the new **Personal Data** menu in the WordPress admin and click **Scan now**.
4. Or run `wp pdscan scan` with WP-CLI.

Scans run in batches and resume where they left off, so large sites with tens of thousands of comments and orders are fine.

== Frequently Asked Questions ==

= Does any data leave my server? =

No. Scanning runs entirely on your server and the plugin makes no outbound requests of any kind.

= Does it store the personal data it finds? =

No. It stores a masked version of each value plus a link to the record it was found in. Uninstalling the plugin drops its tables.

= Why does it report my own admin email? =

Because it is personal data sitting in the options table. Findings on reserved domains like example.com get a low confidence. Use Ignore for anything you have reviewed.

= Does it detect names in free text? =

No. Name detection in prose is noisy and slow. The scanner reports names only in fields whose name says it is a name (first_name, billing_last_name, comment author, and so on).

= Does it work with WooCommerce High-Performance Order Storage? =

Yes. Both HPOS tables and legacy post-based orders are supported, and the mode is detected automatically.

= Can I add my own country's ID format? =

Yes. Formats live in one config file with a pattern, an optional checksum validator and a confidence. Pull requests welcome.

= Is this legal advice? =

No. The scanner shows you where personal data sits. What you must do with it depends on your jurisdiction and your lawful basis for processing.

= Why does Plugin Check report direct database call warnings? =

By design. A personal data scanner has to read raw tables in batches to find data other tools don't know to look for, which is exactly what the object cache and `WP_Query` are not built for. Every query is still safely prepared with `$wpdb->prepare()`; the warnings that remain are false positives from table names built with `$wpdb->prefix`, which Plugin Check cannot statically tell apart from user input. No warning involves unescaped user-supplied data.

== Screenshots ==

1. Dashboard: how many personal data items were found, in how many places, by type and by source.
2. Findings: filter, search, open the record, ignore in bulk.
3. Report: printable inventory with a source-by-type matrix and the records holding the most data.
4. Settings: choose sources and detectors.

== Changelog ==

= 0.1.1 =
* Two new detectors: addresses in labelled fields, and API keys/secrets (AWS, GitHub, Stripe, OpenAI, Anthropic, Google, Slack, JWTs, PEM/SSH private keys).

= 0.1.0 =
* Initial release: eight data sources, nine detectors, admin dashboard, findings, report and settings screens, WP-CLI commands, persistent ignore list.

== Upgrade Notice ==

= 0.1.1 =
Adds address and API key/secret detectors.

= 0.1.0 =
Initial release.
