pg_anon Open-Source Tool Receives Major Updates for PostgreSQL Data Masking and Partial Database Operations

Tantor Labs has released version 1.11.0 of pg_anon, an open-source utility designed to mask personal data in PostgreSQL databases while preserving structure and relationships. The update introduces packaging as a standard Python package, support for partial dumps and restores using whitelist and blacklist dictionaries, and improved handling of complex schema elements such as partitioned tables, generated columns, and custom types. Performance improvements include switching the dump engine to asyncio, single-query metadata collection, and on-the-fly gzip compression to reduce memory usage on large databases. New CLI options allow clean or drop operations on target databases, privilege ignoring, and passthrough of pg_dump and pg_restore flags. A REST API was added to enable integration into CI/CD pipelines and automated self-service systems for nightly masked database refreshes. The tool helps organizations comply with data protection requirements by creating pseudonymized copies suitable for development, testing, and contractor environments.

HabrSeptember 5, 2026Translated from Russian

Read at source

pg_anon, an open-source tool developed by Tantor Labs for masking personal data in PostgreSQL, has received significant updates over the past year. The new version 1.11.0 introduces packaging as a standard Python package, support for partial database dumps and restores, enhanced handling of complex schemas, and a REST API for automation.

The tool addresses a common challenge in organizations that need to create copies of production databases for developers, analysts, or contractors without exposing real personal data. Direct copying of production databases risks violating internal security policies and data protection laws such as 152-FZ and GDPR. pg_anon performs masking by replacing field values with plausible alternatives while keeping table structures and referential integrity intact, resulting in a pseudonymized dataset.

Installation and New CLI Structure

Installation now uses standard pip commands with optional dependency groups. Users can install the base package or add support for the REST API and development tools. Two commands are provided after installation: pg_anon for core operations and pg_anon_api for running the REST service. Each operation mode is now a separate subcommand, improving usability compared to the previous single-entry-point approach.

Partial Dump and Restore Capabilities

A major addition is support for partial dumps and restores. Administrators can specify tables to include or exclude using dictionary files passed via command-line options. The tool automatically collects DDL for dependent objects such as custom types, domains, and functions to ensure successful restoration on a clean target database without manual pre-creation of supporting objects.

Performance and Schema Improvements

The dump engine was rewritten using asyncio instead of multiprocessing. Metadata collection now uses a single query instead of per-table connections, dramatically reducing preparation time on databases with thousands of tables. Compression was changed to a streaming model with lower gzip levels, eliminating memory leaks on large JSON-heavy tables. Support was added for partitioned tables, inherited tables, generated columns, identity sequences, and object names containing special characters.

REST API and Automation

The new REST API enables integration into automated pipelines. Standardized error codes, operation identifiers, custom headers, and log retrieval features support use in CI/CD systems that refresh masked database copies on a schedule without human intervention.

The release maintains backward compatibility with older command syntax while providing a more structured and extensible foundation for data masking workflows in regulated environments.

PostgreSQL pg_anon Tantor Labs GDPR

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately

The article provides a detailed guide on strengthening iPhone privacy by limiting unauthorized access to messages, location data, photos, and cloud backups. It explains how to set a strong alphanumeric passcode, enable Stolen Device Protection, and restrict lock screen notifications and widgets. Users are advised to review Apple ID security, enable Advanced Data Protection for iCloud, and minimize app permissions for location, contacts, and camera. Additional steps include turning off cross-app tracking, using private Wi-Fi addresses, and activating Lockdown Mode for high-risk scenarios. The guide emphasizes regular updates, encrypted local backups, and periodic audits of shared access and active sessions to maintain long-term protection.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026

Public DNS resolvers differ significantly in their ability to block malicious domains, filter advertising and tracking, respect user privacy, and support modern encryption protocols. The guide evaluates ten services including Quad9, Cloudflare, AdGuard DNS, NextDNS, Control D, CleanBrowsing, Mullvad DNS, DNS4EU, Google Public DNS and DNS.SB, providing IPv4 addresses, DoH and DoT endpoints, and recommended use cases. Key distinctions include Quad9’s focus on phishing and malware blocking without logging, Mullvad’s strict no-logs policy requiring encrypted protocols only, and DNS4EU’s EU-based infrastructure with mandatory court-ordered blocks. The article explains why DNSSEC and encryption alone are insufficient and outlines four practical selection criteria: threat filtering quality, data-handling practices, encryption support, and network stability. Detailed configuration instructions cover Windows 11, Android, iOS, and home routers, along with verification methods and warnings against mixing providers with conflicting policies.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers

The article from Aurorium details how WebRTC technology can leak real IP addresses even when users route traffic through proxies. It explains the peer-to-peer mechanics of WebRTC, the role of STUN servers in generating ICE candidates, and why standard TCP proxies fail to handle UDP traffic. Disabling WebRTC via flags or JavaScript extensions creates detectable anomalies that anti-fraud systems flag as non-standard environments. The recommended approach involves native emulation inside the browser kernel so that STUN requests return proxy IPs while preserving full API integrity across workers. Additional leaks through local network addresses, mDNS candidates, and IPv6 are also covered with practical verification methods using tools like BrowserLeaks and CreepJS.

HabrOct 26, 2026Translated from Russian