Privacy on Oliseus Blog

PrivDev: What a Code Scanner Can Tell Us About Privacy

simon.bernbeck@gmail.com (Simon Bernbeck) — Mon, 05 Oct 2026 00:00:00 +0000

A developer can search a codebase for personal data and still miss the question that matters: what should the team do with the finding? A scanner may report an email address or a storage pattern. It cannot see the full purpose of processing, the people involved, every technical safeguard, or the organisation’s legal decisions. PrivDev began with that gap between a technical observation and a responsible privacy review.

PrivDev is my research project at PUC-Rio’s AISE Laboratory. Its working idea is a security-to-privacy bridge: preserve what a scanner actually observed, connect it to a shared vocabulary, and make the reasoning available for inspection. I want developers to receive a useful starting point while leaving decisions that require context with the people who have it.

PrivDev: Why a Cryptography Finding Needs Context

simon.bernbeck@gmail.com (Simon Bernbeck) — Mon, 05 Oct 2026 00:00:00 +0000

Cryptography often appears in privacy discussions as a single checkbox: encrypted or not encrypted. Software findings are rarely that complete. A scanner can identify a suspicious storage path or a call to an unsafe primitive, but it does not automatically know what data is involved, who can read it, which controls exist outside the analysed code, or whether the data needed to be stored in the first place.

That gap is a useful case for PrivDev, my research on connecting technical findings to privacy concepts. The project’s implemented first layer maps scanner data-type labels to a common vocabulary. A later research question asks how findings about software weaknesses could support developer guidance without turning a technical clue into a legal verdict. Cryptography exposes why this distinction matters.

PrivDev: Turning Static-Analysis Findings into Privacy Knowledge

simon.bernbeck@gmail.com (Simon Bernbeck) — Wed, 29 Jul 2026 00:00:00 +0000

The first PrivDev study connects data-type labels from a code scanner to a privacy vocabulary. That sounds straightforward until a label is ambiguous, the vocabulary has no close match, or a graph asserts more than the scanner could know. This article records what the first implementation accomplished and what later review changed. For the wider research programme, see the PrivDev introduction.

From a scanner label to a category
#

Bearer CLI provides the 122 input data-type labels used in this study. The pipeline relates them to personal-data categories in the Data Privacy Vocabulary’s PD extension. The output is an RDF/Turtle graph that can be queried with SPARQL. It records a proposed interpretation of each scanner label, not a description of every real processing activity in which that label might occur.

Privacy on Oliseus Blog

PrivDev: What a Code Scanner Can Tell Us About Privacy

PrivDev: Why a Cryptography Finding Needs Context

PrivDev: Turning Static-Analysis Findings into Privacy Knowledge

From a scanner label to a category #

From a scanner label to a category
#