How much does zuzu.codes cost?

The starter track is free — read all lessons and practice for free. Full access to every track (current and future) is $14.99/month. Cancel anytime.

How long does each track take?

Each track is designed as a 30-day challenge — one lesson per day, about 15 minutes each. Go at your own pace, but the structure is built around daily consistency.

What's the lesson format?

Each lesson is a student-teacher dialogue with code examples, followed by a hands-on code challenge in an in-browser editor. You read, you understand, then you write real code.

Do I need prior coding experience?

Our beginner track starts from absolute zero — no prior experience needed. Advanced tracks build on earlier ones, and the platform tells you exactly where to start.

How is zuzu.codes different from freeCodeCamp or Codecademy?

zuzu.codes uses a structured 30-day track format with dialogue-based teaching, an in-browser code editor, and gamification (XP, streaks, progress tracking). The format builds genuine understanding through daily practice.

PII detection — Ai Mastery

Day 16 · ~11 min●

Production rule: customer text often contains PII — emails, phone numbers, IDs. Sending it raw to a third-party LLM is a leak. Redact before send.

python

import re

PATTERNS = {
    "EMAIL": r'[\w.+-]+@[\w-]+\.[\w.-]+',
    "PHONE": r'\b\d{3}[-.\s]?\d{3}[-.\s]?\d{4}\b',
    "SSN": r'\b\d{3}-\d{2}-\d{4}\b',
}

def redact(text):
    for label, pattern in PATTERNS.items():
        text = re.sub(pattern, f'[{label}]', text)
    return text

print(redact("Email me at jane@acme.com or call 555-123-4567"))
# → Email me at [EMAIL] or call [PHONE]

Regex catches all of it?

Common shapes, yes. Edge cases (international phone formats, unusual emails) leak through. Production stacks layer regex with NER models or commercial PII detectors. For first-line defense, regex is 80% of the value at 5% of the effort.

And the model still understands the redacted text?

Usually. "Customer at [EMAIL] complained" → the model treats [EMAIL] as an opaque token but follows the rest. If the model needs to act on the email, you'd un-redact in your code after the model decides what to do.

PII detection — regex-first defense

python

import re

PATTERNS = {
    "EMAIL": re.compile(r'[\w.+-]+@[\w-]+\.[\w.-]+'),
    "PHONE": re.compile(r'\b\d{3}[-.\s]?\d{3}[-.\s]?\d{4}\b'),
    "SSN": re.compile(r'\b\d{3}-\d{2}-\d{4}\b'),
}

def redact(text):
    out = text
    for label, pat in PATTERNS.items():
        out = pat.sub(f'[{label}]', out)
    return out

def has_pii(text):
    return any(p.search(text) for p in PATTERNS.values())

Two public functions. redact rewrites; has_pii flags.

Where this fits in your pipeline

python

user_input = receive_user_message()
if has_pii(user_input):
    log_pii_seen(user_input)            # alert / metric
clean = redact(user_input)
response = Agent(model).run_sync(clean).output

Redact at the boundary — before the LLM sees the text. The redacted version is what gets logged, what flows through prompts, what's sent to third parties.

Patterns to know

Type	Regex sketch	Notes
Email	`[\w.+-]+@[\w-]+\.[\w.-]+`	RFC-compliant emails are much more complex; this catches 95%+
US phone	`\b\d{3}[-.\s]?\d{3}[-.\s]?\d{4}\b`	International numbers don't match — multi-region needs more patterns
US SSN	`\b\d{3}-\d{2}-\d{4}\b`	Strict format only; 9 raw digits also looks like an SSN
Credit card	Luhn algorithm + format	Beyond regex; use the `creditcard` libraries
Names, addresses	NER required	Regex can't reliably tag names — those need a small model

When regex isn't enough

For real PII compliance (GDPR, HIPAA), you'd combine:

Regex for structured PII (emails, phones, SSNs)
NER (named entity recognition) for names, locations, organizations
LLM-as-detector as a final pass — "identify any remaining PII"
Allow-listing — only proceed with text that passed all three

For a track lesson we cover layer 1. The pattern composes — same redact/has_pii API, layered detectors inside.

Day 16 · ~11 min●

Production rule: customer text often contains PII — emails, phone numbers, IDs. Sending it raw to a third-party LLM is a leak. Redact before send.

python

import re

PATTERNS = {
    "EMAIL": r'[\w.+-]+@[\w-]+\.[\w.-]+',
    "PHONE": r'\b\d{3}[-.\s]?\d{3}[-.\s]?\d{4}\b',
    "SSN": r'\b\d{3}-\d{2}-\d{4}\b',
}

def redact(text):
    for label, pattern in PATTERNS.items():
        text = re.sub(pattern, f'[{label}]', text)
    return text

print(redact("Email me at jane@acme.com or call 555-123-4567"))
# → Email me at [EMAIL] or call [PHONE]

Regex catches all of it?

And the model still understands the redacted text?

PII detection — regex-first defense

python

import re

PATTERNS = {
    "EMAIL": re.compile(r'[\w.+-]+@[\w-]+\.[\w.-]+'),
    "PHONE": re.compile(r'\b\d{3}[-.\s]?\d{3}[-.\s]?\d{4}\b'),
    "SSN": re.compile(r'\b\d{3}-\d{2}-\d{4}\b'),
}

def redact(text):
    out = text
    for label, pat in PATTERNS.items():
        out = pat.sub(f'[{label}]', out)
    return out

def has_pii(text):
    return any(p.search(text) for p in PATTERNS.values())

Two public functions. redact rewrites; has_pii flags.

Where this fits in your pipeline

python

user_input = receive_user_message()
if has_pii(user_input):
    log_pii_seen(user_input)            # alert / metric
clean = redact(user_input)
response = Agent(model).run_sync(clean).output

Redact at the boundary — before the LLM sees the text. The redacted version is what gets logged, what flows through prompts, what's sent to third parties.

Patterns to know

Type	Regex sketch	Notes
Email	`[\w.+-]+@[\w-]+\.[\w.-]+`	RFC-compliant emails are much more complex; this catches 95%+
US phone	`\b\d{3}[-.\s]?\d{3}[-.\s]?\d{4}\b`	International numbers don't match — multi-region needs more patterns
US SSN	`\b\d{3}-\d{2}-\d{4}\b`	Strict format only; 9 raw digits also looks like an SSN
Credit card	Luhn algorithm + format	Beyond regex; use the `creditcard` libraries
Names, addresses	NER required	Regex can't reliably tag names — those need a small model

When regex isn't enough

For real PII compliance (GDPR, HIPAA), you'd combine:

Regex for structured PII (emails, phones, SSNs)
NER (named entity recognition) for names, locations, organizations
LLM-as-detector as a final pass — "identify any remaining PII"
Allow-listing — only proceed with text that passed all three

For a track lesson we cover layer 1. The pattern composes — same redact/has_pii API, layered detectors inside.

PII detection — regex-first defense

Where this fits in your pipeline

Patterns to know

When regex isn't enough

PII detection — regex-first defense

Where this fits in your pipeline

Patterns to know

When regex isn't enough

PII detection — regex-first defense

Where this fits in your pipeline

Patterns to know

When regex isn't enough

Sign up to practice

PII detection — regex-first defense

Where this fits in your pipeline

Patterns to know

When regex isn't enough

Sign up to practice