# PII Masking & Query Hash Anonymization > Source-anchored research for PII Masking & Query Hash Anonymization. Run status: COMPLETED. Parent: [Diagnostic Tool Design](https://llms-explorer.com/tree/diagnostic-tool-design/) · 5 facets · 19 facts · page: https://llms-explorer.com/tree/pii-masking-query-hash-anonymization/ ## Structure and components - Removing query values does not necessarily remove PII: Atlas explicitly warns that field names can contain it, and Percona's redacted-log example retains field names while concealing values. (high confidence) — [source](https://www.mongodb.com/docs/atlas/query-shape-insights.md) - MongoDB's query-stats implementation describes one-way HMAC tokens as preserving the ability to recognize repeated identifiers. Identifier transformation therefore preserves correlation within a key context; it does not erase query structure or equality relationships. (medium confidence) — [source](https://github.com/mongodb/mongo/blob/master/src/mongo/db/query/query_stats/README.md) ## How it works - The anonymongo repository documents post-processing MongoDB log files and Atlas logs, optional namespace hashing, and experimental field-name redaction. It also offers reversible string encryption, so that mode must not be described as irreversible anonymization. These are maintainer-described capabilities, not an independent security audit. (low confidence) (verified as of 2026-10-23) — [source](https://github.com/yuvalherziger/anonymongo) ## Problems, failure modes and limitations - Atlas warns that query shapes can contain PII in field names even when values are redacted. Independent anonymongo documentation identifies the same risk in dynamic schemas and offers field-name redaction. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/query-shape-insights.md) - Percona Server for MongoDB 8.0 documents security.redactClientLogData and runtime setParameter support. Its warning explicitly excludes debug messages and system.profile collection contents from redaction. Field names and diagnostic metadata can remain visible. (low confidence) (verified as of 2025-12-02) — [source](https://docs.percona.com/percona-server-for-mongodb/8.0/log-redaction.html) - A Rocket.Chat user provided a MongoDB 4.0.23 log example containing plaintext message content and usernames. The later follow-up attributed the logging to slow inserts. This is a historical firsthand report, not evidence of current Atlas behavior. (low confidence) — [source](https://forums.rocket.chat/t/mongodb-logging-private-messages-in-plain-text/10832) - MongoDB's May 13, 2026 advisory CVE-2026-8200 separately identifies schema-validation log messages that may fail to redact user data. The advisory lists affected releases before 7.0.34, 8.0.23, 8.2.9, and 8.3.2; the listed boundaries are advisory-specific, not a universal redaction guarantee. (medium confidence) (verified as of 2026-05-13) — [source](https://www.mongodb.com/resources/products/alerts) ## Comparisons and alternatives - $queryStats groups similar queries by replacing user-provided values with type markers. It retains certain operational-option literals, including readConcern and readPreference; this is structured normalization rather than removal of every literal. (low confidence) — [source](https://www.mongodb.com/docs/manual/reference/operator/aggregation/querystats/) - OWASP recommends excluding or transforming secrets, sensitive personal information, and connection strings in logs, and testing logging behavior and access controls. Applied to MongoDB, the documented exposure through field names, debug output, and profiler records supports testing each output surface rather than relying on one redaction setting. (medium confidence) — [source](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) ## Facts and statements - Atlas Query Shape Insights uses a query shape hash to identify shapes for users lacking permission to see query shapes. Authorized roles can see the shapes, including field names. A UI hash identifier should therefore be distinguished from HMAC transformation of identifiers inside exported query statistics. (medium confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/query-shape-insights.md) - $queryStats transformIdentifiers applies HMAC-SHA-256 using a supplied private key to database names, collection names, and document field names. Operators and language parameter names remain readable; user field values are normalized separately. (medium confidence) — [source](https://www.mongodb.com/docs/manual/reference/operator/aggregation/querystats/) - The query-stats HMAC preserves repeat-identifier correlation, while the client application name remains literal. Operators should therefore keep PII out of application names; this recommendation follows from the documented residual metadata. (medium confidence) — [source](https://www.mongodb.com/docs/manual/reference/operator/aggregation/querystats/) - A query-shape hash used to label an Atlas UI row and $queryStats HMAC transformation have different documented roles. Do not assume that displaying a hash proves field names, namespaces or application metadata have all been sanitized. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/query-shape-insights.md) - MongoDB documents Atlas query-statistics collection using an HMAC key unique to each Atlas organization and a four-year retention period. These product-policy details require periodic re-verification. (low confidence) (verified as of 2026-10-22) — [source](https://www.mongodb.com/docs/manual/reference/operator/aggregation/querystats/) - mlogcensor uses an allowlist of recognizable log lines and substitutes field names and namespaces. It also writes rejected lines to unredacted_lines.log; review and protect that side file before sharing a sanitized export. (low confidence) — [source](https://github.com/johnlpage/mlogcensor) - MongoDB [redacted] records a historical bug caused by confusing always-on password stripping with redactClientLogData. The issue was fixed in 3.4.17, 3.6.7 and 3.7.4; password masking alone was not equivalent to PII log redaction. (low confidence) — [source](https://example.test/withheld-reference) - MongoDB published CVE-2026-82069 on September 8, 2026 for improper query-literal redaction in query-statistics serialization on sharded routers, affecting MongoDB 8.3 versions before 8.3.9. This scopes blanket statements that query statistics never expose literals. (low confidence) (verified as of 2026-09-08) — [source](https://www.mongodb.com/resources/products/alerts) - MongoDB's July 7, 2025 advisory CVE-2025-6711 identifies incomplete query redaction in server logs and lists affected releases before 6.0.21, 7.0.18, and 8.0.5. This historical defect is evidence that redaction behavior must be checked against the deployed version. (low confidence) (verified as of 2025-07-07) — [source](https://www.mongodb.com/resources/products/alerts) - anonymongo documents numeric and boolean redaction as disabled by default, namespace hashing as opt-in, and a field-name regular-expression mode that leaves nonmatching fields intact. Its broad privacy claims require checking the selected options against representative logs. (low confidence) (verified as of 2026-10-23) — [source](https://github.com/yuvalherziger/anonymongo)