.svg)
Solutions
Protect sensitive data and intellectual property
Find the customer data in your code and APIs, see what agents touch, and fix its risks first.
orders-api · endpoint
GET/customers/{id}Authenticated
Returns
emailPII
card_last4Financial
Regulations
GDPRPCI DSS
SQL injection on this pathHandles PII · Chaining: reaches PII datastore
UrgentFix in 14 daysAuto-fix PR open, validated in your CI
The challenge
Coding agents write the code that handles your customer data. Where is it at risk?
Which fields hold customer data?Unknown
Which APIs return it?Unknown
Which flaws put it at risk?Unknown
In the agent
See what goes into the agent.
The Workstation Sensor records each coding-agent session: prompts, tool calls, skills and MCP servers.
Prompts and tool calls, per session
Skills and MCP servers in use
Secrets found in transcripts
Claude Code · orders-apiAgent session
Add a phone field to CustomerPrompt
edit models/customer.py
Tool callheelerMCP server
STRIPE_SECRET_KEY in the transcriptSecret found
Your data
Know where customer data lives.
Data Inventory classifies fields from your models, schemas and API contracts, and maps them to the regulations they fall under.
PII, PHI and financial data, by field
GDPR, CCPA, HIPAA, PCI DSS and SOX
The endpoints that take it in or return it
Data Inventory
Data Inventory · orders-apiFields
customers.email
PIIGDPRCCPApatients.diagnosis
PHIHIPAApayments.card_last4
FinancialPCI DSSEndpoints
GET/customers/{id}
Returns PIIAuthenticatedPOST/signup
Takes in PIIPublicFix first
Flaws that touch customer data, fixed first.
Sensitive data on the path raises a finding's impact. Auto-fix opens the PR.
Impact raised when the path handles PII
Chaining: reaches PII datastore
Fix PRs validated in your CI
New findingSQL injectionGET /customers/{id}
AutotriageUrgent
Handles PIIChaining: reaches PII datastore
Auto-fixPR #377 · parameterized queryCI green · merge-ready
Keys
Leaked keys checked live, then rotated.
Each secret is checked with its provider. Live ones go to the owner to rotate, then get checked again.
Checked live with the provider
Ticket to the owning team
Checked again after rotation
Secrets · orders-apiLive check
SecretStatusNext
AWS access keydeploy/env.sh:12
LiveRotate nowPLAT-87 · Team Platform
Stripe secret keyagent transcript
RotatedChecked againno longer live
GitHub tokenscripts/release.sh
Not liveNo actionKnow where your customer data lives. Fix what puts it at risk first.
