PII masking is always an afterthought when building a backends 50m active params means it can actually run in production.