pii.national_id_us
A US Social Security number appears in the free text.
What it looks at#
A nine-digit number in the SSA’s ddd-dd-dddd layout. Numbers the SSA never issues are
rejected: area 000, 666 or 900-999, group 00, serial 0000. Numbers that were
printed in advertisements and sample cards and are shared by thousands of people
(078-05-1120, 219-09-9999, 457-55-5462) are rejected too. There is no check digit,
so the ranges are the whole validity test.
The dashed form is flagged on its own. Nine digits without dashes, or separated by spaces,
are only flagged with SSN or social security within about 40 characters; otherwise every
order number would match. Phone numbers (415-555-0132), dates, and ZIP+4 codes
(94103-1234) do not match the layout.
Why it matters#
An SSN plus a name is what most US identity theft needs, and it cannot be reissued the way a card number can.
What to do#
High severity. Redact it, and find out why it reached a free-text field. A bare undashed number with no keyword nearby is not caught; that is a stated gap.
Example#
curl -s -X POST https://api.stormdoor.dev/v1/pii \
-H "Authorization: Bearer sk_live_..." \
-H "content-type: application/json" \
-d '{"text":"Employee SSN: 123-45-6789","redact":"mask"}'The response carries one pii.national_id_us finding.