ScrutoraNotes on where data actually goes.
Findings from real codebases, clause by clause, mostly written because something surprised us during a scan.
It's rarely that a company doesn't have a data flow map. It's that the one they have describes a version of the product that no longer exists. What manual maps cost in DSAR hours and incident response, and how to automate it. Part 1 of 2.
A mature Java clinical trial platform scanned against HIPAA, and a seeded TypeScript healthcare repository scanned against DPDPA. What tracing regulated fields through the code actually turns up in both. Part 2 of 2.
A technical breakdown of DPDPA Section 8(5) and DPDP Rules 2025, Rule 6. What the law says, what it means for engineering teams, and why passing every clause still isn't the same as being reasonable. Pillar post for a seven-part series.
Encryption, obfuscation, masking, or virtual tokens are examples of 'appropriate,' not four separate requirements. Part 1 of 7 in our DPDPA Rule 6 series.
Rule 6(1)(b) inherits the IT Act's broad definition of 'computer resource' - wider than most access-control programmes assume. Part 2 of 7 in our DPDPA Rule 6 series.
A company that ships logs to a bucket and never looks at them has, technically, produced logs. That's not visibility. Part 3 of 7 in our DPDPA Rule 6 series.
Backups that exist but have never been tested for restorability aren't a continuity measure. They're an assumption. Part 4 of 7 in our DPDPA Rule 6 series.
One year is settled. What it applies to, incident logs only or personal data broadly, is a real open question in tension with DPDPA's own minimisation principle. Part 5 of 7.
A right to audit that's never exercised is functionally the same as not having the right. Part 6 of 7 in our DPDPA Rule 6 series.
A checklist can confirm a control exists. It can't confirm the control is being observed. Part 7 of 7 in our DPDPA Rule 6 series.
A practical, copy-paste guide to running offline DPDPA/HIPAA/GDPR/PCI compliance scanning in every major pipeline - GitHub Actions, GitLab CI, CircleCI, Bitbucket, Azure Pipelines, Google Cloud Build - plus pre-commit, Docker and VS Code. No API key; your code never leaves your runner.
DPDP Rules, one clause at a time. #1: Rule 6(1)(c) doesn't ask whether you have logs - it asks whether they let you detect unauthorised access to personal data. The catch: the same logs are usually leaking that data. What the clause requires, what the code actually does, and the evidence a regulator will accept.
SHEIN, Google, Healthline, Todd Snyder, and Honda all had a consent banner. All five were fined anyway. Five 2025 enforcement actions describe the same failure from five angles - and exactly where a runtime monitor would have caught it.
A secure application isn't necessarily a compliant one. Why SAST, dependency scanning, and secret scanning can't answer the questions GDPR, HIPAA, and DPDPA actually ask of your code.
Across 3,000+ healthcare repositories, a recurring code-level compliance gap: applications ship a default admin account and never force, flag, or detect a credential change. Access control that depends on memory isn't access control.
Real code patterns from 3,000+ healthcare repositories: PHI in logs, TLS disabled, Math.random() for OTPs, patient data sent to LLMs, and XXE in medical parsers. What they violate and how to fix them.
The trust architecture of AI is a structural design flaw, not a privacy policy problem. Every major communication technology followed the same arc: built for connection, trusted by users, exploited when incentives changed. AI is next.
The Healthcare Code Compliance Security Index reveals systemic compliance failures across healthcare software. 43.7% of repos contain confirmed violations, including findings in Google, CDC, VA, NHS, and OpenEMR.
Your policies say PHI is protected. Your code says otherwise. Why the gap between compliance documentation and application code is where breaches and fines live.
Your Snyk scan passed. Your code is still leaking patient data. The gap between security scanning and compliance scanning is where audit failures, regulatory violations, and seven-figure fines live.
We found PHI leaking into logs in 4 out of 6 open-source healthcare systems we scanned. Here are the patterns to look for, the HIPAA risk they create, and how to fix them in your codebase.
When OCR comes knocking, they don’t ask for your policy binder. They ask for evidence. Why the gap between compliance documentation and application code is where fines and breaches live.
India's DPDPA enforcement hits May 2027 with penalties up to ₹250 crore. A practical code-level compliance guide covering encryption, consent, data flows, and what to change in your codebase now.
Using AST-based static analysis across 4 programming languages, we discovered weak cryptography, missing access controls, PHI logging, and insecure session management across widely used healthcare applications.