feature: Add KB entry for PII leaked in network traffic#294
feature: Add KB entry for PII leaked in network traffic#294Nouri-Anouar wants to merge 1 commit into
Conversation
Existing LEAKING_PERSONAL_INFORMATION entry only covers PII found in local files/logs. This adds a sibling entry scoped to PII detected in HTTP request/response traffic, following the same pattern as LEAKING_CREDENTIALS_LOGS / LEAKING_CREDENTIALS_REQUEST.
There was a problem hiding this comment.
Code Review Summary
Total Issues Found: 1
Critical Issues: 0
Suggestions: 1
Key Findings:
The review identified a minor grammatical issue in a metadata JSON file. Specifically, the word "Information" is an uncountable noun and should be paired with the singular verb "was" instead of "were".
Overall Assessment:
The overall code quality is good. The only findings are minor grammatical inconsistencies in text strings, which do not impact functionality.
Recommendations:
- Update the phrasing in the
LEAKING_PERSONAL_INFORMATION_REQUESTmeta.json file to use correct grammar. - Address the same grammatical issue in the existing
LEAKING_PERSONAL_INFORMATIONentry in a follow-up task to ensure consistency across the codebase.
| @@ -0,0 +1,53 @@ | |||
| { | |||
| "risk_rating": "medium", | |||
| "short_description": "Personally Identifiable Information were detected leaked in network traffic.", | |||
There was a problem hiding this comment.
"Information" is an uncountable noun and takes the singular verb "was". Consider changing to: "Personally Identifiable Information was detected leaked in network traffic." or rephrasing to "Personally Identifiable Information (PII) was detected in network traffic."
Note: The existing LEAKING_PERSONAL_INFORMATION entry has the same grammar issue ("were detected"). It would be good to fix both in a follow-up.
| "short_description": "Personally Identifiable Information were detected leaked in network traffic.", | |
| "short_description": "Personally Identifiable Information was detected leaked in network traffic.", |
Summary
LEAKING_PERSONAL_INFORMATIONentry only covers PII found in local files/logs.LEAKING_PERSONAL_INFORMATION_REQUEST, scoped to PII detected in HTTP request/response traffic — same pattern asLEAKING_CREDENTIALS_LOGS/LEAKING_CREDENTIALS_REQUEST.agent_sensitive_info_detectoronce it's extended to scan network traffic.Test plan
pytest tests/kb_test.pystructural checks pass (json validity, unique folder/title names, valid category codes)