Scanning for Data Privacy Issues
Overview
Scan codebases for data privacy violations, PII exposure, and non-compliance
with privacy regulations including GDPR, CCPA, HIPAA, and LGPD. This skill
detects hardcoded personal data, unprotected PII in logs and databases,
missing consent mechanisms, improper data retention, and insufficient
anonymization or pseudonymization of sensitive fields.
Prerequisites
- Access to the target codebase and configuration files in
${CLAUDESKILLDIR}/
- Knowledge of the data types processed by the application (PII categories, PHI, financial data)
- Standard shell utilities and Grep/Glob available for pattern matching
- Reference:
${CLAUDESKILLDIR}/references/README.md for scanner API documentation, GDPR compliance guide, and sensitive data pattern definitions
Instructions
- Define the PII categories relevant to the application: email addresses, phone numbers, Social Security numbers, credit card numbers, IP addresses, geolocation data, biometric data, health records, and any domain-specific identifiers.
- Scan source code for hardcoded PII using regex patterns -- detect email patterns (
[a-zA-Z0-9+_.-]+@[a-zA-Z0-9.-]+), SSN patterns (\d{3}-\d{2}-\d{4}), credit card patterns (Luhn-valid 13-19 digit sequences), and phone number patterns. Flag each as CWE-312 (Cleartext Storage of Sensitive Information).
- Examine logging statements (
console.log, logger.info, logging.debug, Log.d) for PII field references -- flag any logging of user email, password, token, SSN, or credit card fields as CWE-532 (Insertion of Sensitive Information into Log File), severity high.
- Analyze database schemas and ORM models for PII fields stored without encryption -- check for columns named
email, phone, ssn, dateofbirth, address that lack encryption-at-rest annotations or transparent data encryption.
- Review data transmission: verify PII is transmitted over TLS only, check for PII in URL query parameters (visible in server logs and browser history), and flag unencrypted API responses containing sensitive fields.
- Assess consent management: search for cookie consent implementations, privacy policy links, data processing agreements, and opt-in/opt-out mechanisms. Flag applications collecting PII without documented consent flows as a GDPR Article 6/7 gap.
- Check data retention: look for automated data deletion jobs, retention policy configurations, and user data export/deletion endpoints (GDPR Article 17 Right to Erasure). Flag absence of retention controls.
- Evaluate anonymization and pseudonymization: verify that analytics, reporting, and non-production environments use anonymized or pseu
