Leak GateLeak Gate

How it works

The detection is plain code you can read in this repository. The model does one job: turning a captured line into the code change that stops it, inside the merge request, where the same drill then checks its work.

  1. 1

    A merge request is pushed

    GitLab CI builds the shop from the merge request and deploys a review copy to its own AWS Lambda function, with its own log group.

    GitLab CI · AWS Lambda · .gitlab-ci.yml

  2. 2

    The drill plants a synthetic customer

    Every field gets its own unique tag: name, email, phone, password and address. A hit in any sink names exactly one field.

    drill job · packages/drill/src/canary.ts

  3. 3

    She signs up, checks out and asks for help

    Four real requests to the review shop. Each one writes an access line, so the drill knows when the logs it needs have landed.

    drill job → review shop · packages/drill/src/journeys.ts

  4. 4

    Every sink is read

    CloudWatch Logs for the shop's runtime logs, the captures of every vendor call, and the shop's user table.

    CloudWatch Logs · DynamoDB · packages/drill/src/sinks.ts

  5. 5

    Exact match against the data map

    privacy/datamap.yml says where each field may go. A planted value anywhere else is a leak. No model decides this step.

    drill job · packages/drill/src/compare.ts

  6. 6

    The merge request is blocked with evidence

    The job fails and publishes a JUnit report, a GitLab security report and a summary with the captured lines.

    GitLab merge request · packages/drill/src/report.ts

  7. 7

    A GitLab Duo flow fixes it, or holds it

    The failed pipeline triggers a custom flow. It reads the leak report, traces each captured line to the code that wrote it, commits the smallest change that stops the leak, and the pipeline runs the same drill again. If the data reached a destination the data map does not list, it changes no code and holds the merge request for the privacy lead, as on !2.

    GitLab Duo Agent Platform · .gitlab/duo/flows/leak-fix.yaml

  8. 8

    A person approves the outcome

    Green pipeline, then the privacy lead runs the manual production job. The release carries the updated record of processing.

    GitLab environments · releases · .gitlab-ci.yml

  9. 9

    Production keeps being drilled

    A scheduled pipeline drills production every hour and opens an issue if a planted value shows up where it should not.

    GitLab schedules · issues · .gitlab-ci.yml