detect-data-leaks

# Scope — what is PII, what is NOT We only consider PII that is sent to third-party services. Any call to our own backend with PII is not considered a data leak. Every third-party service should be considered, but each has a different risk level. Logging services are the highest risk. Some information is only PII in context — for example, public addresses are not PII by themselves, but on a logging service such as Datadog, an address can be linked to a location and device, allowing identification of the person behind it. Crash reports need to be studied alongside logs — they are a common source of data leaks. Any service that queries the blockchain for an address is **not** a concern — the query is mandatory for the system to function and the data is not linked to any other identifiable information. This applies to all coin modules. Examples: - Kaspa → `api.kaspa.org` - EVM (Ethereum, BSC, Polygon…) → Etherscan-family - Tron → TronGrid (`api.trongrid.io`) # Known third-party sinks in this repo Prioritize these, but do not exclude others: - Datadog - Sentry - Mixpanel # High-risk variables Treat any of these as high-risk when found in added lines: `location.pathname`, `window.location.hash`, `address`, `walletAccountId`, `txId`, `publicKey`, `signature`, `rawData`, `payinAddress`, `fromAccountAddress`, `toAccountAddress`, `binaryPayload` # Process 1. Run `git diff develop...HEAD`. This is the primary source — start here, not from grep. 2. In added lines, identify: - Assignments of high-risk variables (see above) - New calls to third-party sinks or wrappers: `track()`, `trackPage()`, `logger.*()`, `captureException()` 3. In removed lines, identify: - Removed guards: `confidentialityFilter`, scrubbing calls, PII-stripping wrappers — flag each removal as a potential leak enabler. 4. For each high-risk variable in added lines, trace its lineage: - Check if it flows into a sink call within the diff - If it may pass through intermediate calls, read the affected file to follow the chain 5. For each new sink call in the diff: - Read surrounding context in the file - Follow the call chain to determine what gets serialized - If the call is a wrapper (e.g. `track()`), read its implementation — do not assume from the name 6. Use the grep commands below only to trace a pattern already found in the diff. Never run them independently to source findings. 7. Score each finding 1–10. Report only those scoring 7 or higher with a concrete fix. # Grep helpers (investigation only) **`location.pathname` flowing into `track()`** — pathname often assigned before the call: ```bash find apps \( -name "*.ts" -o -name "*.tsx" \) | grep -vE "\.test\.|/__tests__/|/tests/" | \ xargs perl -0777 -ne 'BEGIN { exit unless @ARGV } print "$ARGV\n" if /track(?:Page)?\([\s\S]{0,500}?location\.pathname/' ``` **`window.location.hash` in analytics:** ```bash grep -rn "window\.location\.hash" apps/ --include="*.ts" --include="*.tsx" ``` **Address interpolated into `new Error(...)` in coin modules:** ```bash find libs \( -name "*.ts" -o -name "*.tsx" \) | grep -vE "live-e2e-shared|coin-tester-modules|__tests__|tests|\.test\." | \ xargs perl -0777 -ne 'BEGIN { exit unless @ARGV } print "$ARGV\n" if /new Error\(`[\s\S]{0,300}?\$\{[^}]*(address|sender|hash|walletAccountId|txId|publicKey)[^}]*\}/i' ``` **Signed tx payload on broadcast failure:** ```bash grep -rn -E "broadcast_failure|broadcastLogger" apps/ --include="*.ts" | grep -v "\.test\." ``` **Full transaction object spread into analytics:** ```bash grep -rn -E "value:[[:space:]]*(params|transaction)\b" apps/ --include="*.ts" --include="*.tsx" \ | grep -v "\.test\." \ | grep -vE "value:[[:space:]]*(params|transaction)\." ``` **Signed payload fields in `track()`:** ```bash grep -rn -E "binaryPayload|payinAddress|fromAccountAddress|toAccountAddress" libs/ apps/ --include="*.ts" --include="*.tsx" \ | grep -vE "\.test\.|/__tests__/|/tests/" ``` **Props filter registration (the shared pipeline applies it to both `track()` and `trackPage()`):** ```bash grep -rn "setPropsFilter(" apps/ --include="*.ts" --include="*.tsx" | grep -v test ``` Desktop registers `confidentialityFilter`; check whether any other app that sends analytics needs a filter. # Output format - Score mapping: 9-10 → 🔴 Critical, 7–8 → 🟡 Suggestion. Scores below 7 are not reported. - If no findings reach score 7, produce no output. ``` 🔴 Critical (10/10) — apps/.../useActivityIndicator.ts:39 track("SyncErrorList", { page: location.pathname, ... }); Fix: remove `page` from the payload or replace with a static route label stripped of account IDs. 🟡 Suggestion (8/10) — apps/.../someFile.ts:12 track("Event", { hash: window.location.hash }); Fix: pass only the route segment before the `#`, not the full hash. ``` # References `.agents/skills/client-ids/SKILL.md`