feat: PIPA-RET-001 personal-data retention detector - #11
Merged
Conversation
Flags personal-data fields (email, phone, resident number, and Korean equivalents) stored without any destruction or retention-limit handling — the risk that personal information is kept indefinitely, which PIPA Article 21 addresses (destroy once the purpose is met). This is the inverse of ECA-RET-001, which flags missing preservation of transaction records, so the two do not overlap. Precision: only stored field declarations count (not method signatures or log statements), and any destruction/retention marker anywhere in the file clears it. Six tests plus a fixture; wired into the registry and both test registries; README/detector tables updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
rostradamus
added a commit
that referenced
this pull request
Jul 3, 2026
Ships the PIPA-RET-001 personal-data retention detector (#11). Bumps the README action example to rostradamus/klaws@v0.1.4. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a sixth detector (the roadmap's data-retention item), giving PIPA a fourth check and filling a real gap: personal data kept with no destruction policy.
PIPA-RET-001→ flags personal-data field declarations (email, phone, resident number, + Korean equivalents) when the file shows no destruction / retention-limit handling. Maps to PIPA Art. 21 (destroy personal info once its purpose is met).ECA-RET-001(which flags missing preservation of transaction records), so the two are distinct, not redundant.Precision
MemberEntity/ProfileEntityfields, not on the logging service or method params).deletedAt,expire,purge,anonymize,파기,보관기간, …) anywhere in the file clears it.Test plan
ProfileEntity.javafixturego build,go vet,go test ./...,gofmt -l .clean; README (EN/KO) + roadmap updated🤖 Generated with Claude Code