Engineering evidence for DPDPA readiness: code, website, consent, controls, artifacts, tickets, and optional AI synthesis. Generated 07 Jul 2026, 17:00 IST.
The report is organized around evidence that can be assigned: notice gaps, sensitive data, logging exposure, processor review, encryption, monitoring, vulnerability management, and breach readiness.
Legal / Privacy | P0 | Notice transparency
Engineering / Security | P0 | Security safeguards
Engineering / Security | P1 | Security safeguards
Legal / Privacy | P1 | Notice transparency
ai | Configure AI provider
Use this before sharing the report externally. It separates what Svikruti inspected from what still needs human or production-system proof.
| Repository | examples/realistic |
| Website URL | Not provided |
| Privacy notice evidence | Not detected |
| Files scanned | 15 |
| Website pages scanned | 0 |
| Evidence items | 183 |
| Security imports | 8 |
Direct/verified evidence can support release review. Inferred and unknown evidence should be confirmed by an owner.
| Confidence | Items |
|---|---|
| Medium | 109 |
| High | 38 |
| Low | 36 |
Engines show how source files were interpreted. Heuristic engines are conservative and should be treated as review signals.
| Engine | Files/signals |
|---|---|
| go.handler_heuristic | 1 |
| java.spring_heuristic | 1 |
| js_ts.endpoint_heuristic | 3 |
| kubernetes.manifest_heuristic | 1 |
| openapi.schema_heuristic | 1 |
| php.laravel_heuristic | 1 |
| python.ast | 1 |
| ruby.rails_heuristic | 1 |
| schema.field_heuristic | 2 |
For production repositories, run with parser packs, privacy notice input, browser consent capture, and security imports.
python -m pip install -e '.[parsers]'
svikruti scan --repo . --privacy-url https://example.com/privacy \
--security-evidence semgrep.sarif --security-evidence trivy.json \
--browser-consent --out dpdpa-evidence.html --json-out dpdpa-evidence.jsonEvidence-backed technical controls for encryption, secrets, vulnerability management, monitoring, incident response, and recovery.
Replace insecure personal-data transport with HTTPS/TLS and document any internal exceptions.
Gaps: Insecure HTTP endpoint detected
Refs: insecure_controls.js:4:technical.insecure_transport.http_endpoint
Remove weak crypto/secrets and prove storage encryption or managed-key usage for personal-data stores.
Gaps: Gitleaks secret: generic-api-key, Hard-coded token, MD5 hashing
Refs: gitleaks.json:gitleaks:0, insecure_controls.js:3:technical.weak_crypto.md5_hashing, insecure_controls.js:5:technical.secret_exposure.hard_coded_token, platform_controls.tf:technical.encryption_evidence.kms_managed_keys, platform_controls.tf:technical.encryption_evidence.storage_encryption, risky_cloud.tf:technical.encryption_evidence.storage_encryption
Remove hard-coded secrets, rotate credentials, and move secrets to managed storage.
Gaps: Gitleaks secret: generic-api-key, Hard-coded token
Refs: gitleaks.json:gitleaks:0, insecure_controls.js:5:technical.secret_exposure.hard_coded_token
Triage imported critical/high vulnerabilities and block release until accepted or fixed.
Gaps: Trivy vulnerability: CVE-2026-0001
Refs: security_pipeline.yml:technical.security_tooling.code_ql, security_pipeline.yml:technical.security_tooling.gitleaks, security_pipeline.yml:technical.security_tooling.semgrep, security_pipeline.yml:technical.security_tooling.trivy, semgrep.sarif:sarif:0:0, trivy.json:trivy:CVE-2026-0001
Confirm production scope, owner, and retention of this evidence.
Gaps: None
Refs: platform_controls.tf:technical.endpoint_security.guard_duty, platform_controls.tf:technical.security_monitoring.cloud_watch, security_pipeline.yml:technical.security_monitoring.pager_duty
Confirm production scope, owner, and retention of this evidence.
Gaps: None
Refs: platform_controls.tf:technical.incident_readiness.runbook_escalation, security_pipeline.yml:technical.incident_readiness.runbook_escalation
Confirm production scope, owner, and retention of this evidence.
Gaps: None
Refs: platform_controls.tf:technical.resilience_evidence.backup_restore_retention
Fix cloud/IaC exposure such as public storage, public databases, disabled encryption, permissive IAM, or wildcard CORS.
Gaps: Public database exposure, Public storage ACL, Storage encryption disabled
Refs: risky_cloud.tf:3:technical.cloud_misconfiguration.public_database_exposure, risky_cloud.tf:4:technical.cloud_misconfiguration.storage_encryption_disabled, risky_cloud.tf:9:technical.cloud_misconfiguration.public_storage_acl
A technical-readiness register built from code/config evidence and imported scanner results.
Score: 52/100. This is an evidence-readiness view, not a breach certification.
Missing controls: 0
Vulnerability management, monitoring, endpoint or workload detection, incident response, secrets and crypto, backup/recovery, and personal-data impact mapping.
| Domain | Status | Score | Evidence |
|---|---|---|---|
| Vulnerability Management | Needs Action | 25 | security_pipeline.yml:technical.security_tooling.code_ql, security_pipeline.yml:technical.security_tooling.gitleaks, security_pipeline.yml:technical.security_tooling.semgrep, security_pipeline.yml:technical.security_tooling.trivy, semgrep.sarif:sarif:0:0 |
| Security Monitoring | Evidence Present | 80 | platform_controls.tf:technical.security_monitoring.cloud_watch, security_pipeline.yml:technical.security_monitoring.pager_duty |
| Endpoint Or Workload Detection | Evidence Present | 80 | platform_controls.tf:technical.endpoint_security.guard_duty |
| Incident Response | Evidence Present | 80 | platform_controls.tf:technical.incident_readiness.runbook_escalation, security_pipeline.yml:technical.incident_readiness.runbook_escalation |
| Secrets And Crypto | Needs Action | 25 | gitleaks.json:gitleaks:0, insecure_controls.js:3:technical.weak_crypto.md5_hashing, insecure_controls.js:5:technical.secret_exposure.hard_coded_token, platform_controls.tf:technical.encryption_evidence.kms_managed_keys, platform_controls.tf:technical.encryption_evidence.storage_encryption |
| Backup And Recovery | Evidence Present | 80 | platform_controls.tf:technical.resilience_evidence.backup_restore_retention |
| Cloud And Iac Guardrails | Needs Action | 25 | risky_cloud.tf:3:technical.cloud_misconfiguration.public_database_exposure, risky_cloud.tf:4:technical.cloud_misconfiguration.storage_encryption_disabled, risky_cloud.tf:9:technical.cloud_misconfiguration.public_storage_acl |
| Personal Data Mapping | Needs Action | 25 | SpringCustomerController.java:15:semantic.java.request_source.government_id, SpringCustomerController.java:16:code.logging_risk.government_id, SpringCustomerController.java:16:semantic.java.log_sink.government_id, SpringCustomerController.java:5:code.personal_data_reference.identity, SpringCustomerController.java:5:semantic.java.field.identity |
A launch-readiness view that maps scanner evidence to practical DPDPA control areas.
8 notice gaps
Owner: Legal / Privacy
Next: Patch the privacy notice so detected data and vendors are disclosed.
Withdrawal gap detected
Owner: Product / Legal
Next: Verify reject, accept, and withdrawal paths with browser consent mode.
Children, Government ID, Health
Owner: Engineering / Privacy
Next: Confirm strict purpose, retention, and access controls for sensitive data.
1 vendors/tools detected
Owner: Procurement / Legal
Next: Confirm DPA status, purpose, transfer location, and notice disclosure.
8 RoPA starter rows
Owner: Privacy Ops
Next: Export RoPA CSV and complete retention, lawful basis, and owners.
Device/tracking signals detected
Owner: Product / Engineering
Next: Gate non-essential tracking and make preference changes discoverable.
7 logging risks
Owner: Engineering / Security
Next: Mask or remove personal data from logs and define retention.
Children data detected
Owner: Legal / Product
Next: If children data exists, verify guardian consent and age-gating controls.
Checkboxes are stored in this browser so you can use the report as a lightweight review tracker.
Svikruti detected Children data in engineering evidence, but not in the notice text.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: rails_students.rb, react_signup.tsx
Personal data appears near logging statements.
Owner: Engineering / Security | Due: Before launch / next release | Artifact: Logging redaction control
Evidence: rails_students.rb
Personal data appears near logging statements.
Owner: Engineering / Security | Due: Before launch / next release | Artifact: Logging redaction control
Evidence: express_checkout.js, rails_students.rb
Svikruti detected Device data in engineering evidence, but not in the notice text.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: customer_schema.sql, react_signup.tsx
Svikruti detected Financial data in engineering evidence, but not in the notice text.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: express_checkout.js, laravel_checkout.php, schema.prisma
Personal data appears near logging statements.
Owner: Engineering / Security | Due: Before launch / next release | Artifact: Logging redaction control
Evidence: laravel_checkout.php
Svikruti detected Government ID data in engineering evidence, but not in the notice text.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: SpringCustomerController.java, customer_schema.sql, express_checkout.js, openapi.json, schema.prisma
Personal data appears near logging statements.
Owner: Engineering / Security | Due: Before launch / next release | Artifact: Logging redaction control
Evidence: SpringCustomerController.java, express_checkout.js
Svikruti detected Health data in engineering evidence, but not in the notice text.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: django_patient.py, go_patient.go
Personal data appears near logging statements.
Owner: Engineering / Security | Due: Before launch / next release | Artifact: Logging redaction control
Evidence: go_patient.go
Svikruti detected Location data in engineering evidence, but not in the notice text.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: customer_schema.sql, express_checkout.js, laravel_checkout.php, react_signup.tsx
Personal data appears near logging statements.
Owner: Engineering / Security | Due: Before launch / next release | Artifact: Logging redaction control
Evidence: express_checkout.js
The notice does not clearly include DPDPA-relevant withdrawal terms.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: privacy notice text
The notice does not clearly include DPDPA-relevant rights terms.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: privacy notice text
The notice does not clearly include DPDPA-relevant children terms.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: privacy notice text
The notice does not clearly include DPDPA-relevant retention terms.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: privacy notice text
The notice does not clearly include DPDPA-relevant third parties terms.
Owner: Legal / Privacy | Due: Before launch / next release | Artifact: Privacy notice change
Evidence: privacy notice text
Third-party services were detected but processor/vendor disclosure language is missing or weak.
Owner: Legal / Procurement | Due: Before launch / next release | Artifact: Vendor register + notice update
Evidence: Razorpay
Each lane shows how Svikruti connects engineering evidence to notice coverage, DPDPA concern, and action.
| Data | Collection | Storage | Logging | DPDPA Areas | Remediation |
|---|---|---|---|---|---|
| Health Notice: missing | django_patient.py, go_patient.go | django_patient.py, go_patient.go | go_patient.go | Data minimization, Notice transparency, Security safeguards, Storage limitation | Document strict purpose, retention, and access controls for Health.; Update privacy notice to disclose Health data. |
| Identity Notice: covered | django_patient.py, express_checkout.js, react_signup.tsx | SpringCustomerController.java, customer_schema.sql, django_patient.py, express_checkout.js, schema.prisma | None detected | Notice transparency, Storage limitation | No immediate action |
| Contact Notice: covered | django_patient.py, express_checkout.js, go_patient.go, k8s-deployment.yaml, laravel_checkout.php, openapi.json, rails_students.rb, react_signup.tsx | SpringCustomerController.java, customer_schema.sql, django_patient.py, express_checkout.js, go_patient.go, laravel_checkout.php, rails_students.rb, schema.prisma | express_checkout.js, rails_students.rb | Consent and notice, Notice transparency, Security safeguards, Storage limitation | Mask or remove Contact data from logs in express_checkout.js.; Mask or remove Contact data from logs in rails_students.rb. |
| Location Notice: missing | express_checkout.js, laravel_checkout.php, react_signup.tsx | customer_schema.sql, express_checkout.js | express_checkout.js | Notice transparency, Purpose limitation, Storage limitation | Mask or remove Location data from logs in express_checkout.js.; Update privacy notice to disclose Location data. |
| Government ID Notice: missing | SpringCustomerController.java, express_checkout.js, openapi.json | SpringCustomerController.java, customer_schema.sql, express_checkout.js, schema.prisma | SpringCustomerController.java, express_checkout.js | Data minimization, Notice transparency, Security safeguards, Storage limitation | Document strict purpose, retention, and access controls for Government ID.; Mask or remove Government ID data from logs in SpringCustomerController.java.; Mask or remove Government ID data from logs in express_checkout.js.; Update privacy notice to disclose Government ID data. |
| Financial Notice: missing | express_checkout.js, laravel_checkout.php | express_checkout.js, laravel_checkout.php, schema.prisma | laravel_checkout.php | Notice transparency, Security safeguards, Storage limitation | Update privacy notice to disclose Financial data. |
| Children Notice: missing | rails_students.rb, react_signup.tsx | rails_students.rb | rails_students.rb | Children's data, Notice transparency, Security safeguards, Storage limitation | Document strict purpose, retention, and access controls for Children.; Mask or remove Children data from logs in rails_students.rb.; Update privacy notice to disclose Children data. |
| Device Notice: missing | react_signup.tsx | customer_schema.sql | None detected | Notice transparency, Security safeguards, Storage limitation, Tracking and consent | Update privacy notice to disclose Device data. |
RoPA, action, and vendor CSVs include schema versions, evidence references, confidence, and clear fields for human confirmation. See docs/OUTPUT_SCHEMAS.md.
Use the action checklist to assign owners before launch.
Copy the generated drafting aid for privacy/legal review.
Generate CSV/Markdown outputs from the CLI for RoPA, vendors, and remediation.
--ropa-out --actions-out --vendors-out --notice-patch-outGenerate the technical-control register and breach-readiness pack.
--controls-out --breach-out --security-evidenceGenerate evidence-grounded AI brief and rewritten fixes.
--ai --ai-out ai-brief.mdInstall the PR workflow so privacy and technical-control evidence changes are caught during engineering review.
svikruti init-github-actionScope: examples/realistic | URL: not scanned
| Record | Data / Risk | Purpose / Basis | Systems | Processors | Status |
|---|---|---|---|---|---|
| ROPA-001 Health personal-data processing | Health Risk: High | Application processing, Collection through product or website interface, Operational logging or debugging, Storage in application data store Basis: Consent or legitimate use to be confirmed | django_patient.py, go_patient.go Languages: Go, Python | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
| ROPA-002 Identity personal-data processing | Identity Risk: Medium | Application processing, Collection through product or website interface, Storage in application data store Basis: Consent or legitimate use to be confirmed | SpringCustomerController.java, customer_schema.sql, django_patient.py, express_checkout.js, react_signup.tsx, schema.prisma Languages: Java, JavaScript, Python, React/TypeScript, SQL, Unknown | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
| ROPA-003 Contact personal-data processing | Contact Risk: High | Application processing, Collection through product or website interface, Operational logging or debugging, Storage in application data store Basis: Consent or legitimate use to be confirmed | SpringCustomerController.java, customer_schema.sql, django_patient.py, express_checkout.js, go_patient.go, insecure_controls.js, k8s-deployment.yaml, laravel_checkout.php, openapi.json, rails_students.rb, react_signup.tsx, schema.prisma Languages: Go, JSON, Java, JavaScript, PHP, Python, React/TypeScript, Ruby, SQL, Unknown, YAML | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
| ROPA-004 Location personal-data processing | Location Risk: Medium | Application processing, Collection through product or website interface, Operational logging or debugging, Storage in application data store Basis: Consent or legitimate use to be confirmed | SpringCustomerController.java, customer_schema.sql, express_checkout.js, go_patient.go, laravel_checkout.php, react_signup.tsx Languages: Go, Java, JavaScript, PHP, React/TypeScript, SQL | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
| ROPA-005 Government ID personal-data processing | Government ID Risk: High | Application processing, Collection through product or website interface, Operational logging or debugging, Storage in application data store Basis: Consent or legitimate use to be confirmed | SpringCustomerController.java, customer_schema.sql, express_checkout.js, openapi.json, schema.prisma Languages: JSON, Java, JavaScript, SQL, Unknown | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
| ROPA-006 Financial personal-data processing | Financial Risk: High | Application processing, Collection through product or website interface, Operational logging or debugging, Storage in application data store Basis: Consent or legitimate use to be confirmed | express_checkout.js, laravel_checkout.php, schema.prisma Languages: JavaScript, PHP, Unknown | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
| ROPA-007 Children personal-data processing | Children Risk: High | Collection through product or website interface, Operational logging or debugging, Storage in application data store Basis: Consent or legitimate use to be confirmed | rails_students.rb, react_signup.tsx Languages: React/TypeScript, Ruby | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
| ROPA-008 Device personal-data processing | Device Risk: High | Application processing, Collection through product or website interface, Storage in application data store Basis: Consent or legitimate use to be confirmed | customer_schema.sql, k8s-deployment.yaml, react_signup.tsx Languages: React/TypeScript, SQL, YAML | To be confirmed Transfer: To be confirmed | Draft - scanner inferred Owner: Privacy / Product owner to assign |
Copy-ready implementation tickets for GitHub, Jira, or Linear.
Svikruti detected Children data in engineering evidence, but not in the notice text.
Personal data appears near logging statements.
Personal data appears near logging statements.
Svikruti detected Device data in engineering evidence, but not in the notice text.
Svikruti detected Financial data in engineering evidence, but not in the notice text.
Personal data appears near logging statements.
Svikruti detected Government ID data in engineering evidence, but not in the notice text.
Personal data appears near logging statements.
Svikruti detected Health data in engineering evidence, but not in the notice text.
Personal data appears near logging statements.
Optional AI-generated synthesis grounded in this scan result. It is drafting support, not legal advice.
Run this scan with --ai and a configured provider key to generate AI commentary.
svikruti scan --ai --ai-out ai-brief.md ...| Severity | Finding | Type | Location | Recommendation |
|---|---|---|---|---|
| CRITICAL | Health data signal Detected terms patient in code context. | storage_point Python | django_patient.py:4 django_patient.py:4:code.storage_point.health | Document storage location, retention, access controls, and deletion process for this data category. |
| MEDIUM | Identity data signal Detected terms full_name in code context. | storage_point Python | django_patient.py:5 django_patient.py:5:code.storage_point.identity | Document storage location, retention, access controls, and deletion process for this data category. |
| MEDIUM | Contact data signal Detected terms email in code context. | personal_data_reference Python | django_patient.py:6 django_patient.py:6:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms phone, phone_number in code context. | personal_data_reference Python | django_patient.py:7 django_patient.py:7:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms diagnosis in code context. | personal_data_reference Python | django_patient.py:8 django_patient.py:8:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms prescription in code context. | personal_data_reference Python | django_patient.py:9 django_patient.py:9:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms blood_group in code context. | personal_data_reference Python | django_patient.py:10 django_patient.py:10:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms patient in code context. | collection_point Python | django_patient.py:13 django_patient.py:13:code.collection_point.health | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| CRITICAL | Health data signal Detected terms patient in code context. | storage_point Python | django_patient.py:15 django_patient.py:15:code.storage_point.health | Document storage location, retention, access controls, and deletion process for this data category. |
| MEDIUM | Identity data signal Detected terms full_name in code context. | storage_point Python | django_patient.py:16 django_patient.py:16:code.storage_point.identity | Document storage location, retention, access controls, and deletion process for this data category. |
| MEDIUM | Contact data signal Detected terms email in code context. | personal_data_reference Python | django_patient.py:17 django_patient.py:17:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms phone, phone_number in code context. | personal_data_reference Python | django_patient.py:18 django_patient.py:18:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms diagnosis in code context. | personal_data_reference Python | django_patient.py:19 django_patient.py:19:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms prescription in code context. | personal_data_reference Python | django_patient.py:20 django_patient.py:20:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms blood_group in code context. | personal_data_reference Python | django_patient.py:21 django_patient.py:21:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Third-party service detected: Razorpay Code references Razorpay, which may receive personal data or tracking events. | third_party JavaScript | express_checkout.js express_checkout.js:third_party.reference | Confirm purpose, contract/DPA status, transfer location, retention, and whether the privacy notice names this recipient category. |
| MEDIUM | Identity data signal Detected terms full_name in code context. | personal_data_reference JavaScript | express_checkout.js:7 express_checkout.js:7:code.personal_data_reference.identity | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms email, email_address in code context. | personal_data_reference JavaScript | express_checkout.js:8 express_checkout.js:8:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms address in code context. | personal_data_reference JavaScript | express_checkout.js:8 express_checkout.js:8:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms mobile, mobile_number in code context. | personal_data_reference JavaScript | express_checkout.js:9 express_checkout.js:9:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms address, address_line in code context. | personal_data_reference JavaScript | express_checkout.js:10 express_checkout.js:10:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms pincode in code context. | personal_data_reference JavaScript | express_checkout.js:11 express_checkout.js:11:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms pan_number in code context. | personal_data_reference JavaScript | express_checkout.js:12 express_checkout.js:12:code.personal_data_reference.government_id | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| HIGH | Financial data signal Detected terms upi, upi_id in code context. | collection_point JavaScript | express_checkout.js:13 express_checkout.js:13:code.collection_point.financial | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| HIGH | Contact data signal Detected terms email, email_address, mobile, mobile_number in code context. | logging_risk JavaScript | express_checkout.js:16 express_checkout.js:16:code.logging_risk.contact | Avoid logging personal data unless strictly necessary; mask or hash values and define retention. |
| CRITICAL | Government ID data signal Detected terms pan_number in code context. | logging_risk JavaScript | express_checkout.js:16 express_checkout.js:16:code.logging_risk.government_id | Avoid logging personal data unless strictly necessary; mask or hash values and define retention. |
| MEDIUM | Possible Location data signal Detected terms address in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | logging_risk JavaScript | express_checkout.js:16 express_checkout.js:16:code.logging_risk.location | Avoid logging personal data unless strictly necessary; mask or hash values and define retention. |
| MEDIUM | Identity data signal Detected terms full_name in code context. | storage_point JavaScript | express_checkout.js:19 express_checkout.js:19:code.storage_point.identity | Document storage location, retention, access controls, and deletion process for this data category. |
| MEDIUM | Contact data signal Detected terms email, email_address in code context. | personal_data_reference JavaScript | express_checkout.js:20 express_checkout.js:20:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms address in code context. | personal_data_reference JavaScript | express_checkout.js:20 express_checkout.js:20:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms mobile, mobile_number in code context. | personal_data_reference JavaScript | express_checkout.js:21 express_checkout.js:21:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms address, address_line in code context. | personal_data_reference JavaScript | express_checkout.js:22 express_checkout.js:22:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms pincode in code context. | personal_data_reference JavaScript | express_checkout.js:23 express_checkout.js:23:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms pan_number in code context. | personal_data_reference JavaScript | express_checkout.js:24 express_checkout.js:24:code.personal_data_reference.government_id | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Financial data signal Detected terms upi, upi_id in code context. | personal_data_reference JavaScript | express_checkout.js:25 express_checkout.js:25:code.personal_data_reference.financial | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Identity data signal Detected terms full_name in code context. | personal_data_reference Unknown | schema.prisma:3 schema.prisma:3:code.personal_data_reference.identity | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms email in code context. | personal_data_reference Unknown | schema.prisma:4 schema.prisma:4:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms pan_number in code context. | personal_data_reference Unknown | schema.prisma:5 schema.prisma:5:code.personal_data_reference.government_id | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Financial data signal Detected terms upi, upi_id in code context. | personal_data_reference Unknown | schema.prisma:6 schema.prisma:6:code.personal_data_reference.financial | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Identity data signal Detected terms full_name in code context. | personal_data_reference Java | SpringCustomerController.java:5 SpringCustomerController.java:5:code.personal_data_reference.identity | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms email, email_address in code context. | personal_data_reference Java | SpringCustomerController.java:6 SpringCustomerController.java:6:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms address in code context. | personal_data_reference Java | SpringCustomerController.java:6 SpringCustomerController.java:6:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms pan_number in code context. | personal_data_reference Java | SpringCustomerController.java:7 SpringCustomerController.java:7:code.personal_data_reference.government_id | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms pan_number in code context. | logging_risk Java | SpringCustomerController.java:16 SpringCustomerController.java:16:code.logging_risk.government_id | Avoid logging personal data unless strictly necessary; mask or hash values and define retention. |
| MEDIUM | Contact data signal Detected terms phone in code context. | personal_data_reference JavaScript | insecure_controls.js:3 insecure_controls.js:3:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Possible Children data signal Detected terms student in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | collection_point React/TypeScript | react_signup.tsx:3 react_signup.tsx:3:code.collection_point.children | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| CRITICAL | Children data signal Detected terms student, student_age in code context. | collection_point React/TypeScript | react_signup.tsx:4 react_signup.tsx:4:code.collection_point.children | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Identity data signal Detected terms first_name in code context. | collection_point React/TypeScript | react_signup.tsx:8 react_signup.tsx:8:code.collection_point.identity | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Form field collects Identity Form field 'first_name' appears to collect identity data. | form_field React/TypeScript | react_signup.tsx:8 react_signup.tsx:8:code.form_field.identity | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| MEDIUM | Form field collects Identity Form field 'First name' appears to collect identity data. | form_field React/TypeScript | react_signup.tsx:8 react_signup.tsx:8:code.form_field.identity | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| MEDIUM | Identity data signal Detected terms last_name in code context. | collection_point React/TypeScript | react_signup.tsx:9 react_signup.tsx:9:code.collection_point.identity | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Form field collects Identity Form field 'last_name' appears to collect identity data. | form_field React/TypeScript | react_signup.tsx:9 react_signup.tsx:9:code.form_field.identity | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| MEDIUM | Form field collects Identity Form field 'Last name' appears to collect identity data. | form_field React/TypeScript | react_signup.tsx:9 react_signup.tsx:9:code.form_field.identity | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| HIGH | Contact data signal Detected terms phone in code context. | collection_point React/TypeScript | react_signup.tsx:10 react_signup.tsx:10:code.collection_point.contact | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| CRITICAL | Children data signal Detected terms guardian in code context. | collection_point React/TypeScript | react_signup.tsx:10 react_signup.tsx:10:code.collection_point.children | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| HIGH | Form field collects Contact Form field 'guardian_phone' appears to collect contact data. | form_field React/TypeScript | react_signup.tsx:10 react_signup.tsx:10:code.form_field.contact | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| HIGH | Form field collects Contact Form field 'Guardian phone' appears to collect contact data. | form_field React/TypeScript | react_signup.tsx:10 react_signup.tsx:10:code.form_field.contact | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| CRITICAL | Children data signal Detected terms school in code context. | collection_point React/TypeScript | react_signup.tsx:11 react_signup.tsx:11:code.collection_point.children | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| CRITICAL | Form field collects Children Form field 'school' appears to collect children data. | form_field React/TypeScript | react_signup.tsx:11 react_signup.tsx:11:code.form_field.children | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| CRITICAL | Form field collects Children Form field 'School' appears to collect children data. | form_field React/TypeScript | react_signup.tsx:11 react_signup.tsx:11:code.form_field.children | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| CRITICAL | Children data signal Detected terms student, student_age in code context. | collection_point React/TypeScript | react_signup.tsx:12 react_signup.tsx:12:code.collection_point.children | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| CRITICAL | Form field collects Children Form field 'student_age' appears to collect children data. | form_field React/TypeScript | react_signup.tsx:12 react_signup.tsx:12:code.form_field.children | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| MEDIUM | Possible Location data signal Detected terms address in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | collection_point React/TypeScript | react_signup.tsx:13 react_signup.tsx:13:code.collection_point.location | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Device data signal Detected terms ip_address in code context. | collection_point React/TypeScript | react_signup.tsx:13 react_signup.tsx:13:code.collection_point.device | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Form field collects Device Form field 'ip_address' appears to collect device data. | form_field React/TypeScript | react_signup.tsx:13 react_signup.tsx:13:code.form_field.device | Map this field to a purpose, notice text, retention rule, and withdrawal/deletion workflow. |
| HIGH | Contact data signal Detected terms phone in code context. | collection_point Ruby | rails_students.rb:2 rails_students.rb:2:code.collection_point.contact | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| CRITICAL | Children data signal Detected terms guardian, school, student, student_age in code context. | collection_point Ruby | rails_students.rb:2 rails_students.rb:2:code.collection_point.children | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| HIGH | Contact data signal Detected terms phone in code context. | logging_risk Ruby | rails_students.rb:3 rails_students.rb:3:code.logging_risk.contact | Avoid logging personal data unless strictly necessary; mask or hash values and define retention. |
| CRITICAL | Children data signal Detected terms guardian in code context. | logging_risk Ruby | rails_students.rb:3 rails_students.rb:3:code.logging_risk.children | Avoid logging personal data unless strictly necessary; mask or hash values and define retention. |
| CRITICAL | Children data signal Detected terms student in code context. | logging_risk Ruby | rails_students.rb:4 rails_students.rb:4:code.logging_risk.children | Avoid logging personal data unless strictly necessary; mask or hash values and define retention. |
| MEDIUM | Identity data signal Detected terms full_name in code context. | personal_data_reference SQL | customer_schema.sql:3 customer_schema.sql:3:code.personal_data_reference.identity | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms email, email_address in code context. | personal_data_reference SQL | customer_schema.sql:4 customer_schema.sql:4:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Possible Location data signal Detected terms address in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | personal_data_reference SQL | customer_schema.sql:4 customer_schema.sql:4:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms mobile, mobile_number in code context. | personal_data_reference SQL | customer_schema.sql:5 customer_schema.sql:5:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms aadhaar in code context. | personal_data_reference SQL | customer_schema.sql:6 customer_schema.sql:6:code.personal_data_reference.government_id | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms pan_number in code context. | personal_data_reference SQL | customer_schema.sql:7 customer_schema.sql:7:code.personal_data_reference.government_id | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms address, address_line in code context. | personal_data_reference SQL | customer_schema.sql:8 customer_schema.sql:8:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Location data signal Detected terms pincode in code context. | personal_data_reference SQL | customer_schema.sql:9 customer_schema.sql:9:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Device data signal Detected terms device_id in code context. | personal_data_reference SQL | customer_schema.sql:10 customer_schema.sql:10:code.personal_data_reference.device | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| HIGH | Contact data signal Detected terms email, email_address in code context. | collection_point PHP | laravel_checkout.php:4 laravel_checkout.php:4:code.collection_point.contact | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Possible Location data signal Detected terms address in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | collection_point PHP | laravel_checkout.php:4 laravel_checkout.php:4:code.collection_point.location | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| HIGH | Financial data signal Detected terms upi, upi_id in code context. | collection_point PHP | laravel_checkout.php:5 laravel_checkout.php:5:code.collection_point.financial | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| HIGH | Financial data signal Detected terms upi in code context. | collection_point PHP | laravel_checkout.php:6 laravel_checkout.php:6:code.collection_point.financial | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| HIGH | Contact data signal Detected terms email, email_address in code context. | collection_point PHP | laravel_checkout.php:7 laravel_checkout.php:7:code.collection_point.contact | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| HIGH | Financial data signal Detected terms upi, upi_id in code context. | collection_point PHP | laravel_checkout.php:7 laravel_checkout.php:7:code.collection_point.financial | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Possible Location data signal Detected terms address in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | collection_point PHP | laravel_checkout.php:7 laravel_checkout.php:7:code.collection_point.location | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Contact data signal Detected terms email in code context. | personal_data_reference YAML | k8s-deployment.yaml:12 k8s-deployment.yaml:12:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| HIGH | Contact data signal Detected terms email in code context. | collection_point YAML | k8s-deployment.yaml:16 k8s-deployment.yaml:16:code.collection_point.contact | Ensure the collection point has a clear purpose, notice, consent/legitimate-use basis, and withdrawal path where applicable. |
| MEDIUM | Device data signal Detected terms device_id in code context. | personal_data_reference YAML | k8s-deployment.yaml:17 k8s-deployment.yaml:17:code.personal_data_reference.device | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Government ID data signal Detected terms aadhaar in code context. | personal_data_reference JSON | openapi.json:16 openapi.json:16:code.personal_data_reference.government_id | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms mobile, mobile_number in code context. | personal_data_reference JSON | openapi.json:17 openapi.json:17:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms patient in code context. | personal_data_reference Go | go_patient.go:9 go_patient.go:9:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Contact data signal Detected terms email, email_address in code context. | personal_data_reference Go | go_patient.go:10 go_patient.go:10:code.personal_data_reference.contact | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Possible Location data signal Detected terms address in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | personal_data_reference Go | go_patient.go:10 go_patient.go:10:code.personal_data_reference.location | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms diagnosis in code context. | personal_data_reference Go | go_patient.go:11 go_patient.go:11:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Possible Health data signal Detected terms patient in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | personal_data_reference Go | go_patient.go:14 go_patient.go:14:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| MEDIUM | Possible Health data signal Detected terms patient in code context. No corroborating personal-data token was found nearby, so this is a possible signal only. | personal_data_reference Go | go_patient.go:15 go_patient.go:15:code.personal_data_reference.health | Review purpose, notice coverage, retention, access controls, and minimization for this data element. |
| CRITICAL | Health data signal Detected terms diagnosis, patient in code context. | storage_point Go | go_patient.go:17 go_patient.go:17:code.storage_point.health | Document storage location, retention, access controls, and deletion process for this data category. |
| MEDIUM | Identity model field Parser identified `full_name` as a personal-data field on model/schema `Patient`. | semantic_storage_field Python | django_patient.py:5 django_patient.py:5:semantic.python.model_field.identity | Map this model field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact model field Parser identified `email` as a personal-data field on model/schema `Patient`. | semantic_storage_field Python | django_patient.py:6 django_patient.py:6:semantic.python.model_field.contact | Map this model field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact model field Parser identified `phone_number` as a personal-data field on model/schema `Patient`. | semantic_storage_field Python | django_patient.py:7 django_patient.py:7:semantic.python.model_field.contact | Map this model field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Health model field Parser identified `diagnosis` as a personal-data field on model/schema `Patient`. | semantic_storage_field Python | django_patient.py:8 django_patient.py:8:semantic.python.model_field.health | Map this model field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Health model field Parser identified `prescription` as a personal-data field on model/schema `Patient`. | semantic_storage_field Python | django_patient.py:9 django_patient.py:9:semantic.python.model_field.health | Map this model field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Health model field Parser identified `blood_group` as a personal-data field on model/schema `Patient`. | semantic_storage_field Python | django_patient.py:10 django_patient.py:10:semantic.python.model_field.health | Map this model field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact request collection Parser identified request-body handling for Contact data in `create_patient`. | semantic_collection_point Python | django_patient.py:13 django_patient.py:13:semantic.python.request_source.contact | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| CRITICAL | Health request collection Parser identified request-body handling for Health data in `create_patient`. | semantic_collection_point Python | django_patient.py:13 django_patient.py:13:semantic.python.request_source.health | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| MEDIUM | Identity request collection Parser identified request-body handling for Identity data in `create_patient`. | semantic_collection_point Python | django_patient.py:13 django_patient.py:13:semantic.python.request_source.identity | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Contact database write Parser identified a database write path for Contact data in `create_patient`. | semantic_storage_sink Python | django_patient.py:13 django_patient.py:13:semantic.python.db_sink.contact | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| CRITICAL | Health database write Parser identified a database write path for Health data in `create_patient`. | semantic_storage_sink Python | django_patient.py:13 django_patient.py:13:semantic.python.db_sink.health | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| MEDIUM | Identity database write Parser identified a database write path for Identity data in `create_patient`. | semantic_storage_sink Python | django_patient.py:13 django_patient.py:13:semantic.python.db_sink.identity | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| MEDIUM | Identity request body field Parser heuristic identified request-body field `full_name` on route `POST /checkout`. | semantic_collection_point JavaScript | express_checkout.js:6 express_checkout.js:6:semantic.js.request_body.identity | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Contact request body field Parser heuristic identified request-body field `email_address` on route `POST /checkout`. | semantic_collection_point JavaScript | express_checkout.js:6 express_checkout.js:6:semantic.js.request_body.contact | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Contact request body field Parser heuristic identified request-body field `mobile_number` on route `POST /checkout`. | semantic_collection_point JavaScript | express_checkout.js:6 express_checkout.js:6:semantic.js.request_body.contact | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Location request body field Parser heuristic identified request-body field `address_line` on route `POST /checkout`. | semantic_collection_point JavaScript | express_checkout.js:6 express_checkout.js:6:semantic.js.request_body.location | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Location request body field Parser heuristic identified request-body field `pincode` on route `POST /checkout`. | semantic_collection_point JavaScript | express_checkout.js:6 express_checkout.js:6:semantic.js.request_body.location | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| CRITICAL | Government ID request body field Parser heuristic identified request-body field `pan_number` on route `POST /checkout`. | semantic_collection_point JavaScript | express_checkout.js:6 express_checkout.js:6:semantic.js.request_body.government_id | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Financial request body field Parser heuristic identified request-body field `upi_id` on route `POST /checkout`. | semantic_collection_point JavaScript | express_checkout.js:6 express_checkout.js:6:semantic.js.request_body.financial | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Contact logging sink Parser heuristic identified Contact data being logged. | semantic_logging_sink JavaScript | express_checkout.js:16 express_checkout.js:16:semantic.js.log_sink.contact | Mask, remove, hash, or justify personal data in logs and attach log-retention evidence. |
| CRITICAL | Government ID logging sink Parser heuristic identified Government ID data being logged. | semantic_logging_sink JavaScript | express_checkout.js:16 express_checkout.js:16:semantic.js.log_sink.government_id | Mask, remove, hash, or justify personal data in logs and attach log-retention evidence. |
| HIGH | Contact database write Parser heuristic identified a database write path for Contact data. | semantic_storage_sink JavaScript | express_checkout.js:18 express_checkout.js:18:semantic.js.db_sink.contact | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| HIGH | Financial database write Parser heuristic identified a database write path for Financial data. | semantic_storage_sink JavaScript | express_checkout.js:18 express_checkout.js:18:semantic.js.db_sink.financial | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| CRITICAL | Government ID database write Parser heuristic identified a database write path for Government ID data. | semantic_storage_sink JavaScript | express_checkout.js:18 express_checkout.js:18:semantic.js.db_sink.government_id | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| MEDIUM | Identity database write Parser heuristic identified a database write path for Identity data. | semantic_storage_sink JavaScript | express_checkout.js:18 express_checkout.js:18:semantic.js.db_sink.identity | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| HIGH | Location database write Parser heuristic identified a database write path for Location data. | semantic_storage_sink JavaScript | express_checkout.js:18 express_checkout.js:18:semantic.js.db_sink.location | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| MEDIUM | Identity schema field Schema parser identified `full_name` as a personal-data field. | semantic_storage_field Unknown | schema.prisma:3 schema.prisma:3:semantic.prisma.schema_field.identity | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact schema field Schema parser identified `email` as a personal-data field. | semantic_storage_field Unknown | schema.prisma:4 schema.prisma:4:semantic.prisma.schema_field.contact | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Government ID schema field Schema parser identified `pan_number` as a personal-data field. | semantic_storage_field Unknown | schema.prisma:5 schema.prisma:5:semantic.prisma.schema_field.government_id | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Financial schema field Schema parser identified `upi_id` as a personal-data field. | semantic_storage_field Unknown | schema.prisma:6 schema.prisma:6:semantic.prisma.schema_field.financial | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| MEDIUM | Identity model/schema field Parser heuristic identified `fullName` as a personal-data field. | semantic_storage_field Java | SpringCustomerController.java:5 SpringCustomerController.java:5:semantic.java.field.identity | Map this field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact model/schema field Parser heuristic identified `emailAddress` as a personal-data field. | semantic_storage_field Java | SpringCustomerController.java:6 SpringCustomerController.java:6:semantic.java.field.contact | Map this field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Government ID model/schema field Parser heuristic identified `panNumber` as a personal-data field. | semantic_storage_field Java | SpringCustomerController.java:7 SpringCustomerController.java:7:semantic.java.field.government_id | Map this field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Government ID request source Java parser heuristic identified Government ID data in request source. | semantic_collection_point Java | SpringCustomerController.java:15 SpringCustomerController.java:15:semantic.java.request_source.government_id | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| CRITICAL | Government ID logging sink Java parser heuristic identified Government ID data in logging sink. | semantic_logging_sink Java | SpringCustomerController.java:16 SpringCustomerController.java:16:semantic.java.log_sink.government_id | Mask, remove, hash, or justify personal data in logs and attach log-retention evidence. |
| CRITICAL | Children logging sink Ruby parser heuristic identified Children data in logging sink. | semantic_logging_sink Ruby | rails_students.rb:3 rails_students.rb:3:semantic.ruby.log_sink.children | Mask, remove, hash, or justify personal data in logs and attach log-retention evidence. |
| HIGH | Contact logging sink Ruby parser heuristic identified Contact data in logging sink. | semantic_logging_sink Ruby | rails_students.rb:3 rails_students.rb:3:semantic.ruby.log_sink.contact | Mask, remove, hash, or justify personal data in logs and attach log-retention evidence. |
| CRITICAL | Children database write Ruby parser heuristic identified Children data in database write. | semantic_storage_sink Ruby | rails_students.rb:4 rails_students.rb:4:semantic.ruby.storage_sink.children | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| HIGH | Contact database write Ruby parser heuristic identified Contact data in database write. | semantic_storage_sink Ruby | rails_students.rb:4 rails_students.rb:4:semantic.ruby.storage_sink.contact | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| MEDIUM | Identity schema field Schema parser identified `full_name` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:3 customer_schema.sql:3:semantic.sql.schema_field.identity | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact schema field Schema parser identified `email_address` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:4 customer_schema.sql:4:semantic.sql.schema_field.contact | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact schema field Schema parser identified `mobile_number` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:5 customer_schema.sql:5:semantic.sql.schema_field.contact | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Government ID schema field Schema parser identified `aadhaar_number` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:6 customer_schema.sql:6:semantic.sql.schema_field.government_id | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Government ID schema field Schema parser identified `pan_number` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:7 customer_schema.sql:7:semantic.sql.schema_field.government_id | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Location schema field Schema parser identified `address_line` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:8 customer_schema.sql:8:semantic.sql.schema_field.location | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Location schema field Schema parser identified `pincode` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:9 customer_schema.sql:9:semantic.sql.schema_field.location | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| MEDIUM | Device schema field Schema parser identified `device_id` as a personal-data field. | semantic_storage_field SQL | customer_schema.sql:10 customer_schema.sql:10:semantic.sql.schema_field.device | Map this schema field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact request source Php parser heuristic identified Contact data in request source. | semantic_collection_point PHP | laravel_checkout.php:4 laravel_checkout.php:4:semantic.php.request_source.contact | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Financial request source Php parser heuristic identified Financial data in request source. | semantic_collection_point PHP | laravel_checkout.php:5 laravel_checkout.php:5:semantic.php.request_source.financial | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Financial logging sink Php parser heuristic identified Financial data in logging sink. | semantic_logging_sink PHP | laravel_checkout.php:6 laravel_checkout.php:6:semantic.php.log_sink.financial | Mask, remove, hash, or justify personal data in logs and attach log-retention evidence. |
| HIGH | Contact database write Php parser heuristic identified Contact data in database write. | semantic_storage_sink PHP | laravel_checkout.php:7 laravel_checkout.php:7:semantic.php.storage_sink.contact | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| HIGH | Financial database write Php parser heuristic identified Financial data in database write. | semantic_storage_sink PHP | laravel_checkout.php:7 laravel_checkout.php:7:semantic.php.storage_sink.financial | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| HIGH | Contact runtime config reference Kubernetes manifest references `CUSTOMER_EMAIL` in Deployment configuration. | semantic_runtime_config YAML | k8s-deployment.yaml:12 k8s-deployment.yaml:12:semantic.kubernetes.runtime_config.contact | Confirm this runtime config does not expose personal data and is backed by secrets/config governance. |
| MEDIUM | Device runtime config reference Kubernetes manifest references `DEVICE_ID` in Deployment configuration. | semantic_runtime_config YAML | k8s-deployment.yaml:17 k8s-deployment.yaml:17:semantic.kubernetes.runtime_config.device | Confirm this runtime config does not expose personal data and is backed by secrets/config governance. |
| LOW | Kubernetes secret/config reference Kubernetes manifest references Secret, ConfigMap, image pull secret, or TLS material. | semantic_secret_reference YAML | k8s-deployment.yaml k8s-deployment.yaml:semantic.kubernetes.secret_reference | Confirm secrets are encrypted at rest, access-controlled, rotated, and not storing personal data unnecessarily. |
| HIGH | Contact API request schema Openapi parser heuristic identified Contact data in API request schema. | semantic_collection_point JSON | openapi.json openapi.json:semantic.openapi.request_source.contact | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| CRITICAL | Government ID API request schema Openapi parser heuristic identified Government ID data in API request schema. | semantic_collection_point JSON | openapi.json openapi.json:semantic.openapi.request_source.government_id | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| HIGH | Contact model/schema field Parser heuristic identified `email_address` as a personal-data field. | semantic_storage_field Go | go_patient.go:10 go_patient.go:10:semantic.go.field.contact | Map this field to purpose, retention, access control, deletion, and production data-store evidence. |
| CRITICAL | Health model/schema field Parser heuristic identified `diagnosis` as a personal-data field. | semantic_storage_field Go | go_patient.go:11 go_patient.go:11:semantic.go.field.health | Map this field to purpose, retention, access control, deletion, and production data-store evidence. |
| HIGH | Contact request source Go parser heuristic identified Contact data in request source. | semantic_collection_point Go | go_patient.go:16 go_patient.go:16:semantic.go.request_source.contact | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| CRITICAL | Health request source Go parser heuristic identified Health data in request source. | semantic_collection_point Go | go_patient.go:16 go_patient.go:16:semantic.go.request_source.health | Confirm notice, purpose, consent/legitimate-use basis, validation, and retention for this endpoint. |
| CRITICAL | Health logging sink Go parser heuristic identified Health data in logging sink. | semantic_logging_sink Go | go_patient.go:17 go_patient.go:17:semantic.go.log_sink.health | Mask, remove, hash, or justify personal data in logs and attach log-retention evidence. |
| CRITICAL | Health database write Go parser heuristic identified Health data in database write. | semantic_storage_sink Go | go_patient.go:18 go_patient.go:18:semantic.go.storage_sink.health | Attach storage encryption, access-control, retention, deletion, and backup/restore evidence for this data path. |
| HIGH | MD5 hashing Weak or legacy cryptography pattern detected: MD5 hashing. | weak_crypto JavaScript | insecure_controls.js:3 insecure_controls.js:3:technical.weak_crypto.md5_hashing | Use modern, reviewed cryptography and document the control protecting personal data. |
| HIGH | Insecure HTTP endpoint detected Code or config references a non-local HTTP endpoint. If personal data flows here, transport protection is weak. | insecure_transport JavaScript | insecure_controls.js:4 insecure_controls.js:4:technical.insecure_transport.http_endpoint | Use HTTPS/TLS for personal-data transport or document a tightly scoped internal exception. |
| CRITICAL | Hard-coded token Potential hard-coded secret or credential detected: Hard-coded token. | secret_exposure JavaScript | insecure_controls.js:5 insecure_controls.js:5:technical.secret_exposure.hard_coded_token | Remove the secret, rotate it, and use a managed secret store. |
| HIGH | Public database exposure Cloud or infrastructure misconfiguration pattern detected: Public database exposure. | cloud_misconfiguration Terraform | risky_cloud.tf:3 risky_cloud.tf:3:technical.cloud_misconfiguration.public_database_exposure | Review production exposure, restrict access, enable encryption, and attach cloud control evidence. |
| HIGH | Storage encryption disabled Cloud or infrastructure misconfiguration pattern detected: Storage encryption disabled. | cloud_misconfiguration Terraform | risky_cloud.tf:4 risky_cloud.tf:4:technical.cloud_misconfiguration.storage_encryption_disabled | Review production exposure, restrict access, enable encryption, and attach cloud control evidence. |
| HIGH | Public storage ACL Cloud or infrastructure misconfiguration pattern detected: Public storage ACL. | cloud_misconfiguration Terraform | risky_cloud.tf:9 risky_cloud.tf:9:technical.cloud_misconfiguration.public_storage_acl | Review production exposure, restrict access, enable encryption, and attach cloud control evidence. |
| LOW | Storage encryption evidence Repository contains storage encryption evidence. | encryption_evidence Terraform | risky_cloud.tf risky_cloud.tf:technical.encryption_evidence.storage_encryption | Confirm this protects personal-data systems in production and link it to the technical control register. |
| LOW | CodeQL evidence Repository references CodeQL, indicating vulnerability/security scanning evidence may exist. | security_tooling YAML | security_pipeline.yml security_pipeline.yml:technical.security_tooling.code_ql | Attach scan output or CI run evidence to the DPDPA breach-readiness pack. |
| LOW | Semgrep evidence Repository references Semgrep, indicating vulnerability/security scanning evidence may exist. | security_tooling YAML | security_pipeline.yml security_pipeline.yml:technical.security_tooling.semgrep | Attach scan output or CI run evidence to the DPDPA breach-readiness pack. |
| LOW | Trivy evidence Repository references Trivy, indicating vulnerability/security scanning evidence may exist. | security_tooling YAML | security_pipeline.yml security_pipeline.yml:technical.security_tooling.trivy | Attach scan output or CI run evidence to the DPDPA breach-readiness pack. |
| LOW | Gitleaks evidence Repository references Gitleaks, indicating vulnerability/security scanning evidence may exist. | security_tooling YAML | security_pipeline.yml security_pipeline.yml:technical.security_tooling.gitleaks | Attach scan output or CI run evidence to the DPDPA breach-readiness pack. |
| LOW | PagerDuty monitoring evidence Repository references PagerDuty, indicating logging, monitoring, or alerting coverage. | security_monitoring YAML | security_pipeline.yml security_pipeline.yml:technical.security_monitoring.pager_duty | Confirm alert routing, retention, owner, and incident escalation path. |
| LOW | Incident or breach response evidence Repository contains incident, breach, on-call, or escalation language. | incident_readiness YAML | security_pipeline.yml security_pipeline.yml:technical.incident_readiness.runbook_escalation | Confirm owners, notification workflow, impact assessment, and evidence retention. |
| LOW | KMS / managed keys evidence Repository contains kms / managed keys evidence. | encryption_evidence Terraform | platform_controls.tf platform_controls.tf:technical.encryption_evidence.kms_managed_keys | Confirm this protects personal-data systems in production and link it to the technical control register. |
| LOW | Storage encryption evidence Repository contains storage encryption evidence. | encryption_evidence Terraform | platform_controls.tf platform_controls.tf:technical.encryption_evidence.storage_encryption | Confirm this protects personal-data systems in production and link it to the technical control register. |
| LOW | CloudWatch monitoring evidence Repository references CloudWatch, indicating logging, monitoring, or alerting coverage. | security_monitoring Terraform | platform_controls.tf platform_controls.tf:technical.security_monitoring.cloud_watch | Confirm alert routing, retention, owner, and incident escalation path. |
| LOW | GuardDuty endpoint/security evidence Repository references GuardDuty, indicating endpoint, workload, or cloud security monitoring evidence. | endpoint_security Terraform | platform_controls.tf platform_controls.tf:technical.endpoint_security.guard_duty | Confirm coverage for production assets that process personal data. |
| LOW | Incident or breach response evidence Repository contains incident, breach, on-call, or escalation language. | incident_readiness Terraform | platform_controls.tf platform_controls.tf:technical.incident_readiness.runbook_escalation | Confirm owners, notification workflow, impact assessment, and evidence retention. |
| LOW | Backup or recovery evidence Repository contains backup, recovery, retention, or deletion-protection evidence. | resilience_evidence Terraform | platform_controls.tf platform_controls.tf:technical.resilience_evidence.backup_restore_retention | Confirm backup scope, restore testing, retention, and deletion alignment for personal data. |
| HIGH | Trivy vulnerability: CVE-2026-0001 Example dependency vulnerability for breach-readiness testing | imported_security_finding | requirements.txt trivy.json:trivy:CVE-2026-0001 | Patch, upgrade, suppress with justification, or document risk acceptance before launch. |
| CRITICAL | Gitleaks secret: generic-api-key Example leaked API key for scanner ingestion test | secret_exposure | examples/realistic/insecure_controls.js:5 gitleaks.json:gitleaks:0 | Remove the secret, rotate it, and prove the secret is now managed outside source control. |
| MEDIUM | SARIF finding: javascript.lang.security.audit.detect-non-literal-fs-filename Example SARIF finding imported into Svikruti. | imported_security_finding | examples/realistic/insecure_controls.js:2 semgrep.sarif:sarif:0:0 | Triage this scanner result and attach remediation/acceptance evidence to breach readiness. |
| Source | Relationship | Target | Evidence refs |
|---|---|---|---|
| Children | missing disclosure | Privacy notice | 45, 46, 54, 57, 58, 59, 60, 61 |
| Children | triggers | Children's data | 45, 46, 54, 57, 60, 66, 68, 69 |
| Children | triggers | Notice transparency | 58, 59, 61 |
| Children | triggers | Security safeguards | 133 |
| Children | triggers | Storage limitation | 135 |
| Contact | triggers | Consent and notice | 2, 3, 10, 11, 17, 19, 24, 28 |
| Contact | triggers | Notice transparency | 55, 56, 104, 111, 112, 145, 153, 157 |
| Contact | triggers | Security safeguards | 117, 134, 150 |
| Contact | triggers | Storage limitation | 99, 100, 107, 119, 125, 129, 136, 138 |
| Device | missing disclosure | Privacy notice | 63, 64, 78, 88, 144, 151 |
| Device | triggers | Notice transparency | 64 |
| Device | triggers | Security safeguards | 151 |
| Device | triggers | Storage limitation | 144 |
| Device | triggers | Tracking and consent | 63, 78, 88 |
| Financial | missing disclosure | Privacy notice | 23, 34, 38, 81, 82, 84, 116, 120 |
| Financial | triggers | Notice transparency | 116, 146 |
| Financial | triggers | Security safeguards | 23, 34, 38, 81, 82, 84, 147 |
| Financial | triggers | Storage limitation | 120, 127, 149 |
| Government ID | missing disclosure | Privacy notice | 22, 25, 33, 37, 42, 43, 74, 75 |
| Government ID | triggers | Data minimization | 22, 25, 33, 37, 42, 43, 74, 75 |
| Government ID | triggers | Notice transparency | 115, 131, 154 |
| Government ID | triggers | Security safeguards | 118, 132 |
| Government ID | triggers | Storage limitation | 121, 126, 130, 140, 141 |
| Health | missing disclosure | Privacy notice | 0, 4, 5, 6, 7, 8, 12, 13 |
| Health | triggers | Data minimization | 0, 4, 5, 6, 7, 8, 12, 13 |
| Health | triggers | Notice transparency | 105, 158 |
| Health | triggers | Security safeguards | 159 |
| Health | triggers | Storage limitation | 101, 102, 103, 108, 156, 160 |
| Identity | triggers | Notice transparency | 1, 9, 16, 27, 35, 39, 47, 48 |
| Identity | triggers | Storage limitation | 98, 109, 122, 124, 128, 137 |
| Location | missing disclosure | Privacy notice | 18, 20, 21, 26, 29, 31, 32, 41 |
| Location | triggers | Notice transparency | 113, 114 |
| Location | triggers | Purpose limitation | 18, 20, 21, 26, 29, 31, 32, 41 |
| Location | triggers | Storage limitation | 123, 142, 143 |
| Privacy notice | discloses | Contact | 2, 3, 10, 11, 17, 19, 24, 28 |
| Privacy notice | discloses | Identity | 1, 9, 16, 27, 35, 39, 47, 48 |
| SpringCustomerController.java | contains | Contact | 40, 129 |
| SpringCustomerController.java | contains | Government ID | 42, 43, 130, 131, 132 |
| SpringCustomerController.java | contains | Identity | 39, 128 |
| SpringCustomerController.java | contains | Location | 41 |
| customer_schema.sql | contains | Contact | 71, 73, 138, 139 |
| customer_schema.sql | contains | Device | 78, 144 |
| customer_schema.sql | contains | Government ID | 74, 75, 140, 141 |
| customer_schema.sql | contains | Identity | 70, 137 |
| customer_schema.sql | contains | Location | 72, 76, 77, 142, 143 |
| django_patient.py | contains | Contact | 2, 3, 10, 11, 99, 100, 104, 107 |
| django_patient.py | contains | Health | 0, 4, 5, 6, 7, 8, 12, 13 |
| django_patient.py | contains | Identity | 1, 9, 98, 106, 109 |
| express_checkout.js | contains | Contact | 17, 19, 24, 28, 30, 111, 112, 117 |
| express_checkout.js | contains | Financial | 23, 34, 116, 120 |
| express_checkout.js | contains | Government ID | 22, 25, 33, 115, 118, 121 |
| express_checkout.js | contains | Identity | 16, 27, 110, 122 |
| express_checkout.js | contains | Location | 18, 20, 21, 26, 29, 31, 32, 113 |
| express_checkout.js | references | Razorpay | 15 |
| go_patient.go | contains | Contact | 92, 155, 157 |
| go_patient.go | contains | Health | 91, 94, 95, 96, 97, 156, 158, 159 |
| go_patient.go | contains | Location | 93 |
| insecure_controls.js | contains | Contact | 44 |
| k8s-deployment.yaml | contains | Contact | 86, 87, 150 |
| k8s-deployment.yaml | contains | Device | 88, 151 |
| laravel_checkout.php | contains | Contact | 79, 83, 145, 148 |
| laravel_checkout.php | contains | Financial | 81, 82, 84, 146, 147, 149 |
| laravel_checkout.php | contains | Location | 80, 85 |
| openapi.json | contains | Contact | 90, 153 |
| openapi.json | contains | Government ID | 89, 154 |
| rails_students.rb | contains | Children | 66, 68, 69, 133, 135 |
| rails_students.rb | contains | Contact | 65, 67, 134, 136 |
| react_signup.tsx | contains | Children | 45, 46, 54, 57, 58, 59, 60, 61 |
| react_signup.tsx | contains | Contact | 53, 55, 56 |
| react_signup.tsx | contains | Device | 63, 64 |
| react_signup.tsx | contains | Identity | 47, 48, 49, 50, 51, 52 |
| react_signup.tsx | contains | Location | 62 |
| schema.prisma | contains | Contact | 36, 125 |
| schema.prisma | contains | Financial | 38, 127 |
| schema.prisma | contains | Government ID | 37, 126 |
| schema.prisma | contains | Identity | 35, 124 |
| Application / website | collects | Children | 45, 46, 54, 57, 58, 59, 60, 61 |
| Application / website | logs | Children | 68, 69, 133 |
| Application / website | stores | Children | 135 |
| Application / website | collects | Contact | 53, 55, 56, 65, 79, 83, 87, 104 |
Repository: examples/realistic | URL: not scanned