{
  "id": 6976092,
  "title": "My privacy scan found 412 leaks. 374 of them were one line of my own tooling.",
  "url": "https://urgent.news/2026/09/12/my-privacy-scan-found-412-leaks-374-of-them-were-one-line-of-my-own",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-12T18:58:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mahirhir/my-privacy-scan-found-412-leaks-374-of-them-were-one-line-of-my-own-tooling-bba"
  },
  "original_language": "en",
  "account": "A privacy scan of a repository revealed 412 potential leaks, with 374 of them originating from a single line of code. Initially, the scan appeared to identify sixteen files that needed review, but upon closer inspection, it became clear that the majority of the issues were due to one defect being repeated 374 times. The scan flagged a discrepancy in the path used by the control runs, with 35 path spans spanning 15 documents. However, 3 of the hits were false positives resulting from an ordinary word matching the pattern.\n\nThe scan found that one of the issues was related to a code generator faithfully producing the same line of code two hundred times. The number of hits was the least useful piece of information, as it only provided a broad overview of the situation. Classifying the hits by shape allowed the scan to narrow down the findings to one line of code and a small tail: a class fix for the generator's root line. The rewrite of the emitter path to a relative form and a scanner improvement also contributed to resolving the issue.\n\nThe grouping of the hits allowed for a diagnosis, where the 412 hits were categorized as one pipe. The scanner prints the path, line, and text, and normalizing the variable part of each hit before counting turned a list of 412 issues into a diagnosis. One of the changes required was modifying the scanner to use a token instead of an absolute path. The equality check in the log performed on the field kept working, as it was only comparing the field to itself across runs and never required the path to be real.\n\nA key takeaway from this experience was that a violation count is a symptom count, not a cause count. It is essential to group by shape before deciding on the necessary work. Additionally, it is crucial to check what your own tooling prints into permanent records, as application code and build controls often do not receive the same level of scrutiny as other parts of the codebase.",
  "summary": "Before publishing a repository I ran a scan for anything that should not go out. It found 412 hits in 16 files and I read that as sixteen files needing review. It was one defect, repeated. 412 hits outside the private class 374 the same line, emitted by every control run 35 path spans across 15 documents 3 false positives (an ordinary word matching the pattern) Every control in the build prints…",
  "key_points": [
    "412 potential leaks identified in privacy scan",
    "374 leaks from single line of code",
    "One line of code repeated 200 times in code generator"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}