PII in request logs
Summary
The API gateway forwards email addresses to a logging vendor without an approved data flow.
Evidence
Open scan report →43
44
logger.info({
email: request.user.email,
});The author, reason and technical detail are still present. Inth uses that context to explain what changed and which company promise it may affect.
Read additions and upgrades that create new collection, storage, sharing, tracking, or vendor behavior.
Show the data involved, where it moves, which vendor receives it, and why the change needs review.
Route the finding, propose a code fix when possible, and preserve the decision beside the change.
Developers see the finding with the code. Privacy, legal and compliance get the context they need in Inth.
Trace personal data from collection through processing, storage, and external destinations.
Spot new analytics, advertising, identity, and vendor dependencies as they enter the product.
Connect outbound requests to the service, data category, consent state, and policy record they affect.
Run privacy review in the delivery workflow before the change loses its technical context.
Each finding becomes a durable record of the source, review, fix and final decision.