Cryptography on Oliseus Blog

PrivDev: What a Code Scanner Can Tell Us About Privacy

simon.bernbeck@gmail.com (Simon Bernbeck) — Mon, 05 Oct 2026 00:00:00 +0000

A developer can search a codebase for personal data and still miss the question that matters: what should the team do with the finding? A scanner may report an email address or a storage pattern. It cannot see the full purpose of processing, the people involved, every technical safeguard, or the organisation’s legal decisions. PrivDev began with that gap between a technical observation and a responsible privacy review.

PrivDev is my research project at PUC-Rio’s AISE Laboratory. Its working idea is a security-to-privacy bridge: preserve what a scanner actually observed, connect it to a shared vocabulary, and make the reasoning available for inspection. I want developers to receive a useful starting point while leaving decisions that require context with the people who have it.

PrivDev: Why a Cryptography Finding Needs Context

simon.bernbeck@gmail.com (Simon Bernbeck) — Mon, 05 Oct 2026 00:00:00 +0000

Cryptography often appears in privacy discussions as a single checkbox: encrypted or not encrypted. Software findings are rarely that complete. A scanner can identify a suspicious storage path or a call to an unsafe primitive, but it does not automatically know what data is involved, who can read it, which controls exist outside the analysed code, or whether the data needed to be stored in the first place.

That gap is a useful case for PrivDev, my research on connecting technical findings to privacy concepts. The project’s implemented first layer maps scanner data-type labels to a common vocabulary. A later research question asks how findings about software weaknesses could support developer guidance without turning a technical clue into a legal verdict. Cryptography exposes why this distinction matters.