UNRELEASED DEVELOPMENT SNAPSHOT · READ-ONLY EXCERPT
hooks/shared/no-customer-data-in-screenshot/run.sh
This is the cited technical source at local revision 275a354, inspected on 22 September 2026. It differs from the public release. This reference publishes only the cited sections, not an installable release or the development branch.
Line numbers refer to the complete recorded file. Uncited lines are omitted. Full-file SHA-256: ec4a44135152e2f7be262eabb8d1df74fd188ec40e36aa58af6cc2bedc6494f8.
1
#!/usr/bin/env bash2
# no-customer-data-in-screenshot — Lintel warn-only hook3
set -euo pipefail5
source "$(dirname "${BASH_SOURCE[0]}")/../_input.sh"6
ARTIFACT_DIR="$(hook_input file_path "${1:-}")"7
[ -z "$ARTIFACT_DIR" ] && exit 08
[ ! -d "$ARTIFACT_DIR" ] && exit 010
LINTEL_HOME="${LINTEL_HOME:-$HOME/.lintel}"11
mkdir -p "$LINTEL_HOME/audit"13
# Unified audit writer (hooks/shared/<name>/ → repo-root → bin/). Idempotent source.14
command -v audit_log >/dev/null 2>&1 || source "$(dirname "${BASH_SOURCE[0]}")/../../../bin/_audit.sh"15
# Shared customer-PII patterns (defined once). Using the shared set also gives the16
# DOM scan the name-with-case-id pattern the other two customer hooks already had.17
source "$(dirname "${BASH_SOURCE[0]}")/../_patterns.sh"19
DOM="$ARTIFACT_DIR/dom.html"20
[ ! -f "$DOM" ] && exit 022
joined="$(scan_customer "$(cat "$DOM" 2>/dev/null || true)")"24
if [ -n "$joined" ]; then25
audit_log "hooks" "no_customer_data_in_screenshot" "hook=no-customer-data-in-screenshot" "tier=warn" "artifact_dir=$ARTIFACT_DIR" "patterns_matched=$joined"26
echo "WARN [Lintel hook]: screenshot DOM at $ARTIFACT_DIR contains customer-data tells ($joined)"27
echo "WARN: Quarantine the artifact before sharing. Consider mv to ~/.lintel/quarantine/"28
fi30
exit 0