Use Jev as a semantic PII linter

curl -sS https://router.flatkey.ai/api/alpha/decisions \
  -H "Authorization: Bearer $FLATKEY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "typesafe/jev-1.13",
  "state": "Rule: never write PII (emails, phone numbers, addresses, tokens) to logs.\nFile: src/api/signup.ts  line 42 (added)\n+ logger.info(\"signup ok\", { user: req.body, plan: plan.id });\nContext: req.body = { email, phone, password, referralCode }; logger ships to Datadog; no redaction middleware on this route.\nTask: semantic lint verdict for this line — pass / warn / fail / needs_review (+ pii_severity, redaction_present).",
  "questions": {
    "lint_verdict": {
      "type": "choice",
      "instructions": "Apply the semantic lint rule to the changed code. Rule: changes must not write personally identifiable information (emails, phone numbers, addresses, names, government ids, auth tokens) to logs, analytics or error reports. Decide the lint result for this change.",
      "criteria": {
        "pass": "The change does not write PII anywhere; logged values are ids, counts, enums or already-redacted",
        "warn": "Possible PII exposure that depends on runtime data or configuration; flag it but don'\''t fail the build",
        "fail": "The change clearly writes PII (or an object that contains PII) to a log, analytics event or error report",
        "needs_review": "Not enough context in the diff to judge; a human should look before merge"
      }
    },
    "pii_severity": {
      "type": "score",
      "instructions": "How sensitive is the most sensitive personal data this change could expose in logs or telemetry.",
      "criteria": [
        "none",
        "low",
        "high"
      ]
    },
    "redaction_present": {
      "type": "noul",
      "instructions": "The change already masks, hashes or redacts every personal field before it is logged."
    }
  }
}'

// Node.js 18+ (built-in fetch). Run: FLATKEY_API_KEY=... node jev.mjs
const body = {
  "model": "typesafe/jev-1.13",
  "state": "Rule: never write PII (emails, phone numbers, addresses, tokens) to logs.\nFile: src/api/signup.ts  line 42 (added)\n+ logger.info(\"signup ok\", { user: req.body, plan: plan.id });\nContext: req.body = { email, phone, password, referralCode }; logger ships to Datadog; no redaction middleware on this route.\nTask: semantic lint verdict for this line — pass / warn / fail / needs_review (+ pii_severity, redaction_present).",
  "questions": {
    "lint_verdict": {
      "type": "choice",
      "instructions": "Apply the semantic lint rule to the changed code. Rule: changes must not write personally identifiable information (emails, phone numbers, addresses, names, government ids, auth tokens) to logs, analytics or error reports. Decide the lint result for this change.",
      "criteria": {
        "pass": "The change does not write PII anywhere; logged values are ids, counts, enums or already-redacted",
        "warn": "Possible PII exposure that depends on runtime data or configuration; flag it but don't fail the build",
        "fail": "The change clearly writes PII (or an object that contains PII) to a log, analytics event or error report",
        "needs_review": "Not enough context in the diff to judge; a human should look before merge"
      }
    },
    "pii_severity": {
      "type": "score",
      "instructions": "How sensitive is the most sensitive personal data this change could expose in logs or telemetry.",
      "criteria": [
        "none",
        "low",
        "high"
      ]
    },
    "redaction_present": {
      "type": "noul",
      "instructions": "The change already masks, hashes or redacts every personal field before it is logged."
    }
  }
};

const res = await fetch("https://router.flatkey.ai/api/alpha/decisions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.FLATKEY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify(body),
});
if (!res.ok) throw new Error(`Jev request failed: ${res.status} ${await res.text()}`);
const { answers, usage } = await res.json();
console.log(JSON.stringify(answers, null, 2), usage);

# Python 3.8+ (pip install requests). Run: FLATKEY_API_KEY=... python jev.py
import json, os, requests

body = json.loads(r"""{
  "model": "typesafe/jev-1.13",
  "state": "Rule: never write PII (emails, phone numbers, addresses, tokens) to logs.\nFile: src/api/signup.ts  line 42 (added)\n+ logger.info(\"signup ok\", { user: req.body, plan: plan.id });\nContext: req.body = { email, phone, password, referralCode }; logger ships to Datadog; no redaction middleware on this route.\nTask: semantic lint verdict for this line — pass / warn / fail / needs_review (+ pii_severity, redaction_present).",
  "questions": {
    "lint_verdict": {
      "type": "choice",
      "instructions": "Apply the semantic lint rule to the changed code. Rule: changes must not write personally identifiable information (emails, phone numbers, addresses, names, government ids, auth tokens) to logs, analytics or error reports. Decide the lint result for this change.",
      "criteria": {
        "pass": "The change does not write PII anywhere; logged values are ids, counts, enums or already-redacted",
        "warn": "Possible PII exposure that depends on runtime data or configuration; flag it but don't fail the build",
        "fail": "The change clearly writes PII (or an object that contains PII) to a log, analytics event or error report",
        "needs_review": "Not enough context in the diff to judge; a human should look before merge"
      }
    },
    "pii_severity": {
      "type": "score",
      "instructions": "How sensitive is the most sensitive personal data this change could expose in logs or telemetry.",
      "criteria": [
        "none",
        "low",
        "high"
      ]
    },
    "redaction_present": {
      "type": "noul",
      "instructions": "The change already masks, hashes or redacts every personal field before it is logged."
    }
  }
}""")

res = requests.post(
    "https://router.flatkey.ai/api/alpha/decisions",
    headers={"Authorization": f"Bearer {os.environ['FLATKEY_API_KEY']}"},
    json=body,
    timeout=60,
)
res.raise_for_status()
data = res.json()
print(json.dumps(data["answers"], indent=2), data.get("usage"))

No Flatkey key yet? Get one for Jev 1.13 →