9 October: a showcase without client data

What we did

We built a public showcase with a fictional identity and fictional data. Its controls work so a visitor can try the process.

Before publication, a gate checks the output for traces that should stay private. Replacing a client’s name is not enough.

What the second look found

A simple search could miss names split into fragments or encoded differently. The checks were extended to assess joined and decoded text too.

Publication also needed to stop when human release approval was missing. That boundary was added to the check as well.

What a person approved

A person chose the fictional brand and approved publication on 9 October. The work register records the publication and the checks afterwards.

The rule that stayed

A demonstration may show how something works. A client’s data does not belong in it.

Still open

A scanner can find only what it recognises. New ways for data to leak call for new tests.

• How this was made
• CC BY 4.0