diff --git a/ql/src/semmle/go/security/SensitiveActions.qll b/ql/src/semmle/go/security/SensitiveActions.qll
index caeb62f35a7..36922e4416f 100644
--- a/ql/src/semmle/go/security/SensitiveActions.qll
+++ b/ql/src/semmle/go/security/SensitiveActions.qll
@@ -55,7 +55,8 @@ module HeuristicNames {
    * that is hashed, encrypted, or a test value, and hence non-sensitive.
    */
   string notSensitive() {
-    result = "(?is).*(test|redact|censor|obfuscate|hash|md5|sha|((?<!un)(en))?(crypt|code)).*"
+    result =
+      "(?is).*(test|redact|censor|obfuscate|hash|md5|(?<!un)mask|sha|((?<!un)(en))?(crypt|code)).*"
   }
 }