import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Advisory for sandboxes: production data copied into a sandbox and left unmasked
 * spreads real PII/PHI into a lower-trust environment with weaker controls and
 * broader developer access. This check runs only in sandboxes and looks for
 * populated PII fields as a proxy for "prod data present" — it cannot prove
 * whether Data Mask has run, so it raises an advisory to confirm masking.
 */
export declare class SandboxDataMaskingCheck implements SecurityCheck {
    readonly id = "sandbox-data-masking";
    readonly name = "Sandbox Data Masking";
    readonly category = "Data Security";
    readonly description = "In sandboxes, flags the presence of populated PII fields (likely unmasked production data) and advises running Salesforce Data Mask";
    run(ctx: AuditContext): Promise<CheckResult>;
}
//# sourceMappingURL=SandboxDataMaskingCheck.d.ts.map