A ten-rule PHP redactor removed all 11 pattern-shaped data types in 200 of 200 samples each, but leaked every name and street address.
The Laravel AI SDK event and conversation table store whatever string prompt() receives, so redaction must happen before the call.
Treat a regex redactor as a floor: send fewer fields, swap names for ids you control, and log only redacted text.