Detection reference · Personal data · Updated 2026-11-03

Email addresses

An email address is the identifier that most often rides along in a pasted thread or log. Redaxa matches complete addresses only, so fragments and SSH remotes are not mistaken for mailboxes.

At a glance

Reported as	Email address
Category	Personal data
Severity	medium: a personal identifier with real but indirect harm, such as an email, phone number or address
Replaced with	`[EMAIL]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 193

What it looks like

A complete address: a local part, @, and a domain whose last label has at least two letters, within the length limits of RFC 5321.

Example

You paste

Forward the invoice to maria.rossi@example.com by Friday.

Redaxa returns

Forward the invoice to [EMAIL] by Friday.

Reported as	Email address
Severity	medium: a personal identifier with real but indirect harm, such as an email, phone number or address
Replaced with	`[EMAIL]`

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

src/seed/users.ts: Email address, listed as a reference, not counted as an exposure (severity info). Reserved example/test domain: demonstrative address, not evidence of exposed personal data.
Same value in tests/fixtures/users.ts: Reserved example/test domain: demonstrative address, not evidence of exposed personal data.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

git clone git@github.com:owner/repo.git: not flagged. git@ is an SSH remote, not a mailbox.
Install @scope/package@1.2.3 from npm: not flagged. A package name with a version is not an address.

What to do

If the address belongs to someone else, remove it or replace it with a role ("the client", [EMAIL]) before sharing. Addresses on reserved domains such as example.com are the safe choice for examples.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Sources

Redaxa engine: scanner.ts line 193. Every output on this page was produced by that code when the page was built.
RFC 2606: Reserved top level DNS names (example.com)