Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Add privacy violations to the vulnerabilities taxonomy

Abierto
  • ¿Algo no está bien?
#47 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Estancado
Stack tecnológico
typescript
Área
cli, security

Línea de trabajo

Start by reviewing the existing taxonomy nodes named in the issue: Logging of Sensitive Information (CWE-200) and PII Handling Violations. Run the planned benchmarks against the two prioritized CUJs—data leaks to log files and sensitive flows to third parties—to determine how the taxonomy should expand or split. Done means the relevant privacy violations are represented and benchmark coverage supports the resulting taxonomy.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

The security extension should be able to detect relevant privacy violations.

The current CUJs being prioritized:
P0: CUJ-1: Identify and remove data leaks to log files
A developer is writing code that logs a user's IP address. The Gemini CLI extension acts as a vigilant assistant, instantly flagging such code within the developer's workflow. It provides AI-generated fixes—for example, replacing the IP address with a salted hash or redacting it completely—that can be applied with a single click, ensuring data privacy is maintained without interrupting the developer's flow.

P0: CUJ-2: Identify sensitive flows to 3Ps
The CLI extension proactively identifies and alerts developers when sensitive data types (such as SSNs, telephone numbers, or precise location information) are being transmitted to third-party services.

There are some related nodes in our current taxonomy and we will run benchmarks to decide how to expand/split those nodes to cover specific privacy violations:
Logging of Sensitive Information (CWE-200): Analyze for the logging of sensitive information. Scan the code for logging statements that might write passwords, PII, API keys, or session tokens to application or system logs.
PII Handling Violations: Analyze how the application handles Personally Identifiable Information (PII). Look for improper storage (e.g., unencrypted), insecure transmission, or any use that may violate data privacy regulations.

Lenguaje dominante
TypeScript
Estrellas
795
Forks
59
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de gemini-cli-extensions/security

Todos los issues de gemini-cli-extensions/security

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.