Build a database privacy auditing tool that helps developers find potentially sensitive information exposed through schemas, API responses, logs, exports, and sample records.
Accept database schemas, synthetic datasets, API specifications, sanitized response samples, and configuration files. Identify likely sensitive fields, excessive data exposure, inconsistent redaction, unnecessary duplication, and data that appears to be collected without a clear stated purpose.
Map how potentially sensitive fields flow from storage to endpoints, reports, logs, and downstream consumers when the supplied evidence supports that mapping.
For each finding, explain the evidence, confidence, possible impact, and recommended mitigation. Suggest field-level minimization, masking, retention limits, access restrictions, and safer example data.
Include a test-case generator for verifying that unauthorized fields are not returned in API responses. Use synthetic or explicitly sanitized data by default, and never transmit discovered secrets or personal records to external services.
Clearly distinguish heuristic findings from verified vulnerabilities and avoid claiming regulatory compliance based solely on automated analysis.
0 Comments