A common pattern
A conventional whole-file path may buffer a large payload before returning a transformed copy.
All use cases
Kraton / Streaming data / source-backed demo
Redact card-like numbers as data passes through.
Large inputs do not have to become one opaque upload just to apply a predictable transformation. The streaming demo processes data in chunks and carries only the small amount of state needed across chunk boundaries.
The trade-off
Keep the task. Narrow the handover.
This Kraton demo
The stream-sanitizer demo masks card-like digit sequences across chunk boundaries and keeps memory proportional to the active chunk.
What is actually bounded
The boundary is part of the tool.
The example is useful because it makes the allowed inputs and actions explicit—not because it claims to solve every version of this task.
- The demo targets 13–19 digit sequences shaped like card numbers; it is not a general PII detector.
- Its pipeline handles inputs of 20 MiB and larger in bounded chunks.
- Memory use is O(chunk), rather than requiring the full input to be resident at once.
Where this example stops
Pattern-based masking is not a complete data-loss-prevention system. Validate the transformation against your own data and threat model.
One scenario at a time