Turn Real Exports Into Demo-Safe Fixtures

API list response as a Storybook fixture

An array of records for a customer table story. name and email are faked; id, status, and mrr survive so the table's badges, sorting, and totals render exactly as production.

Input (customers.json):
[
  { "id": "c1", "name": "Sarah Chen", "email": "sarah.chen@acme.io", "status": "active", "mrr": 49 },
  { "id": "c2", "name": "Tomás Reyes", "email": "treyes@globex.com", "status": "past_due", "mrr": 149 }
]

Output (customers-scrambled.json):
[
  { "id": "c1", "name": "Dr. Elena Rosales", "email": "Reanna.Lockman@yahoo.com", "status": "active", "mrr": 49 },
  { "id": "c2", "name": "Marcus Hettinger", "email": "Jaylin.Bode@gmail.com", "status": "past_due", "mrr": 149 }
]

Nested detail response

A single-record detail view with a nested customer object. The walker recurses, faking name/email/phone at the leaf; order_id, total, and the items array are preserved so the detail page renders the same.

Input (order.json):
{
  "order_id": "ord_8821",
  "total": 129.99,
  "customer": { "name": "Priya Nair", "email": "priya@shop.co", "phone": "+44 20 7946 0958" },
  "items": [{ "sku": "A-12", "qty": 2 }]
}

Output (order-scrambled.json):
{
  "order_id": "ord_8821",
  "total": 129.99,
  "customer": { "name": "Dr. Elena Rosales", "email": "Reanna.Lockman@yahoo.com", "phone": "(555) 123-4567" },
  "items": [{ "sku": "A-12", "qty": 2 }]
}

Seeded, stable fixture for visual snapshots

Set a seed so the committed fixture (and the snapshot it produces) is byte-identical on every rebuild — no churn in your story diffs.

Input (team.json):
[{ "id": 1, "name": "Aisha Khan", "email": "aisha@corp.net" }]

seed = 1234

Output (every build with seed 1234, identical):
[{ "id": 1, "name": "<stable fake>", "email": "<stable fake>" }]

Commit this; snapshot tests stay green across regenerations.

camelCase API keys aren't matched

Many APIs use customerName / emailAddress / phoneNumber. These are NOT exact PII tokens, so they pass through with real data. Rename the leaf keys to the bare token before scrambling if you need them faked.

Input (resp.json):
{ "customerName": "Li Wei", "emailAddress": "li.wei@x.com", "plan": "pro" }

Output (resp-scrambled.json):  <-- real PII survives
{ "customerName": "Li Wei", "emailAddress": "li.wei@x.com", "plan": "pro" }

Fix: rename leaf keys to name / email, then re-run:
{ "name": "Mavis Goldner", "email": "Lonnie_Cremin@hotmail.com", "plan": "pro" }

CSV fixture for a seed script

Seeding local dev from a CSV export. PII columns are faked; the IDs and statuses your seed script and foreign keys rely on are preserved.

Input (seed.csv):
id,name,email,role,active
1,Sarah Chen,sarah.chen@acme.io,admin,true

Output (seed-scrambled.csv):
id,name,email,role,active
1,Dr. Elena Rosales,Reanna.Lockman@yahoo.com,admin,true

id / role / active preserved -> your seed script and FKs still work.

API responses commonly use camelCase keys (customerName, emailAddress, phoneNumber). The PII regex is anchored to the whole key name and expects bare tokens, so these are NOT matched and real PII survives into your fixture. Rename the leaf keys to name, email, phone before scrambling, or transform the response shape first.

In the JSON walk a matched key is replaced only when its value is a string or number. If address holds an object ({"line1":..., "city":...}), the parent isn't overwritten — the walker recurses, so a nested city leaf gets faked but line1 (not a token) survives. Structured address objects need PII tokens at the leaf level to be fully faked.

The tool fakes whole values at matched keys and never scans inside strings. A real name or email written inside a bio, description, or message field is shown in your demo unchanged because the key isn't a PII token. Scrub those strings first with email-phone-scrubber, which emits fixed [REDACTED_*] tags.

In-browser the JSON path runs only when the filename ends in .json. A saved API response named response or data.txt is handed to PapaParse as a one-column CSV and produces a useless fixture. Rename to .json, rely on the server-safe auto sniff of a leading [/{, or set format: json.

Without a seed, every scramble produces different fakes, so a committed fixture (and its visual snapshot) changes on every regeneration and pollutes diffs. Set a numeric seed so the same source yields byte-identical output every time — stable fixtures are what snapshot tests need.

Faker replacements are type-appropriate to the PII kind, not to your original value. A phone stored as a number in source JSON becomes a faker phone STRING like (555) 123-4567. If your TypeScript types or formatters expect a numeric phone, adjust the type or post-process — the fake matches the PII kind, not the source primitive.

ssn / tax_id keys are filled with faker.string.numeric(9) — nine random digits, no dashes. If a demo component formats or validates an SSN as NNN-NN-NNNN, the fake won't match that mask. That's the actual behaviour; there's no SSN-format option.

JSON goes through JSON.parse; a trailing comma, single quotes, or a truncated save throws and produces nothing. Re-capture a clean response or repair it before scrambling. CSV is more forgiving — PapaParse parses ragged rows rather than throwing.

Each matched value gets an independent fake, so the same real customer appearing in two parts of a nested response (or across two fixture files) becomes different fakes. If your demo relies on the same name showing in a list and a detail view, you may need to hand-edit the fixture so the linked records agree.