feat: PIPA-XBR-001 third-party/cross-border transfer detector - #13
Merged
Conversation
Flags personal data sent to a third-party or external endpoint without an apparent consent check, mapping to PIPA Article 17 (provision to third parties). Cross-border transfer is a subset of this concern. Precision comes from requiring three signals together in a window around an outbound call (.post/.put/.exchange/.execute/.send): an external destination (http(s) URL, partner, external, 제3자, 외부, 해외, …), a personal-data term, and the absence of consent. Verified it fires only on the intended external transfer across the test corpus. Six tests plus a fixture; registered in the CLI and both test registries; READMEs updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds a new compliance detector (PIPA-XBR-001) to flag potential third-party/cross-border personal-data transfers without an apparent consent check, and wires it into the CLI + test registries with documentation updates.
Changes:
- Introduces
ThirdPartyTransferDetectorwith regex/window-based heuristics for outbound transfer + external target + personal data + missing consent. - Registers the new detector in the CLI dependency graph and in scanner/MCP server test registries.
- Adds unit tests + a Java fixture, and updates README (EN/KO) detector lists and roadmap status.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
internal/detector/transfer.go |
Implements the new PIPA-XBR-001 third-party transfer detector logic. |
internal/detector/transfer_test.go |
Adds targeted unit tests covering core detection/skip scenarios and metadata. |
testdata/TransferService.java |
Adds a fixture containing an external transfer of email/phone data. |
cmd/klaws/main.go |
Registers the detector in the CLI’s default detector registry. |
internal/scanner/scanner_test.go |
Ensures scanner tests include the new detector in the registry setup. |
internal/mcp/server_test.go |
Ensures MCP server tests include the new detector in the registry setup. |
README.md |
Documents the new detector and marks roadmap item as done. |
README.ko.md |
Documents the new detector in Korean. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Copilot review on PR #13 flagged that xbrConsentRe matched 'agree' anywhere, so an explicit non-consent token like 'disagree' would suppress a legitimate PIPA-17 finding. Anchor the token to a word start and add a regression test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the roadmap's last named detector (cross-border transfer), giving PIPA a fifth check and klaws eight detectors.
PIPA-XBR-001→ flags personal data sent to a third-party / external endpoint without an apparent consent check. Maps to PIPA Art. 17 (provision to third parties); cross-border transfer is a subset.Precision (the hard part for this one)
Requires three signals together in a window around an outbound call (
.post/.put/.exchange/.execute/.send):http(s)://,partner,external,overseas,제3자,외부,해외, …consent/agree/동의) nearbyVerified it fires only on the intended external transfer and on none of the other 8 testdata files (internal
.save, marketing sends, etc.).Test plan
TransferService.javafixturego build,go vet,go test ./...,gofmt -l .clean; README (EN/KO) + roadmap updated🤖 Generated with Claude Code