Interpreting Results

Report Structure

A KafkaCode report consists of three main sections:

Scan Summary

High-level overview of the scan results

Issue Listings

Detailed findings grouped by severity

Recommendations

Actionable advice for each issue

Understanding the Scan Summary

🎯 PRIVACY SCAN REPORT
═══════════════════════════════════════════════════════════

📊 SCAN SUMMARY
📁 Directory: ./src
⏰ Timestamp: 2025-01-15 10:30:45
📄 Files Scanned: 25
🔍 Total Issues: 3
🏆 Privacy Grade: 🟡 B-

═══════════════════════════════════════════════════════════

Key Metrics Explained

Metric	Meaning	What to Look For
Directory	Path that was scanned	Verify correct location
Timestamp	When scan was performed	Track scan history
Files Scanned	Number of source files analyzed	Ensure expected coverage
Total Issues	Count of all findings	Lower is better
Privacy Grade	Overall grade (A+ to F)	Target A- or better for production

Privacy Grade Interpretation

🟢 A+ / A / A-

Excellent✅ Production-ready

Minimal to no issues
Safe to deploy
Maintain current practices

🔵 B+ / B / B-

Good⚠️ Minor improvements needed

Generally safe
Address issues when convenient
Review before major releases

🟡 C+ / C / C-

Moderate⚠️ Action required

Notable privacy concerns
Fix before production
Not recommended for deployment

🔴 D / F

Critical❌ Must fix immediately

Security vulnerabilities
Block all deployments
Emergency response needed

Reading Issue Listings

Issues are organized by severity level:

Critical Issues 🔴

🔴 CRITICAL (1)
────────────────────────────────────────────────────────────
  📄 src/config.js:12
     AWS Access Key detected
     aws_access_key_id = "AKIAIOSFODNN7EXAMPLE"

     💡 Recommendation: Move to environment variables

What it means:

Severity: Critical (100 points)
File: src/config.js
Line: 12
Issue: Hardcoded AWS access key
Code: Actual problematic code shown
Action: Move to environment variables immediately

Why it’s critical:

Exposed credentials can be exploited
Direct access to cloud resources
Potential for data breaches
Compliance violations

How to fix:

// ❌ Before (Critical)
const aws_access_key_id = "AKIAIOSFODNN7EXAMPLE";

// ✅ After (Fixed)
const aws_access_key_id = process.env.AWS_ACCESS_KEY_ID;

High Severity Issues 🟠

🟠 HIGH (1)
────────────────────────────────────────────────────────────
  📄 src/auth.js:23
     API key found in code
     const apiKey = "sk_live_abc123..."

     💡 Recommendation: Use configuration management

What it means:

Severity: High (50 points)
Issue: Hardcoded API key (Stripe, GitHub, etc.)
Risk: Potential unauthorized access
Priority: Fix before next release

How to fix:

// ❌ Before (High)
const apiKey = "sk_live_abc123...";

// ✅ After (Fixed)
const apiKey = process.env.STRIPE_API_KEY;

Medium Severity Issues 🟡

🟡 MEDIUM (2)
────────────────────────────────────────────────────────────
  📄 src/utils/validator.js:45
     Email address found in code
     const adminEmail = "admin@company.com"

     💡 Recommendation: Use configuration file

  📄 src/database/connection.js:8
     Potential database connection string
     const dbUrl = "mongodb://localhost:27017/mydb"

     💡 Recommendation: Use environment variables

What it means:

Severity: Medium (10 points each)
Issue: PII or configuration data in code
Risk: Privacy compliance concerns
Priority: Address when convenient

How to fix:

// ❌ Before (Medium)
const adminEmail = "admin@company.com";
const dbUrl = "mongodb://localhost:27017/mydb";

// ✅ After (Fixed)
const adminEmail = config.get('ADMIN_EMAIL');
const dbUrl = process.env.DATABASE_URL;

Low Severity Issues 🔵

🔵 LOW (3)
────────────────────────────────────────────────────────────
  📄 src/config.js:5
     IP address detected
     const serverIP = "192.168.1.100"

     💡 Recommendation: Use DNS names when possible

What it means:

Severity: Low (1 point)
Issue: Minor configuration concerns
Risk: Minimal
Priority: Optional cleanup

How to fix:

// ⚠️ Before (Low)
const serverIP = "192.168.1.100";

// ✅ After (Better)
const serverHost = "api.company.com";

Common Issue Types

1. Hardcoded Secrets

Problem
Solution
Prevention

# ❌ Critical: Exposed AWS credentials
AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"
AWS_SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

# ❌ High: Hardcoded API key
STRIPE_KEY = "sk_live_51H..."

# ❌ Critical: Database password
DB_PASSWORD = "mypassword123"

# ✅ Use environment variables
import os

AWS_ACCESS_KEY = os.getenv('AWS_ACCESS_KEY')
AWS_SECRET_KEY = os.getenv('AWS_SECRET_KEY')
STRIPE_KEY = os.getenv('STRIPE_KEY')
DB_PASSWORD = os.getenv('DB_PASSWORD')

# ✅ Or use a secrets manager
from aws_secrets import get_secret

credentials = get_secret('app-credentials')

Best practices:

Never commit secrets to git
Use .env files (add to .gitignore)
Use secret management tools (AWS Secrets Manager, HashiCorp Vault)
Rotate secrets regularly
Use different secrets per environment

2. PII in Code

Problem
Solution
Compliance

// ❌ Medium: Email addresses
const supportEmail = "support@company.com";
const adminEmail = "admin@company.com";

// ❌ Medium: Phone numbers
const helpline = "+1-555-123-4567";

// ❌ Critical: SSN in test data
const testSSN = "123-45-6789";

// ✅ Use configuration
const supportEmail = config.get('SUPPORT_EMAIL');
const adminEmail = config.get('ADMIN_EMAIL');
const helpline = config.get('HELPLINE_NUMBER');

// ✅ Use mock data generators for tests
const testSSN = faker.ssn();

3. Connection Strings

Problem
Solution
Security

# ❌ Critical: Full connection string with password
DATABASE_URL = "postgresql://user:password@localhost:5432/db"

# ❌ High: MongoDB with credentials
MONGO_URI = "mongodb://admin:pass123@localhost:27017/mydb"

# ❌ Medium: Redis URL
REDIS_URL = "redis://localhost:6379"

# ✅ Use environment variables
import os

DATABASE_URL = os.getenv('DATABASE_URL')
MONGO_URI = os.getenv('MONGO_URI')
REDIS_URL = os.getenv('REDIS_URL')

# ✅ Or build from separate env vars
DB_HOST = os.getenv('DB_HOST')
DB_USER = os.getenv('DB_USER')
DB_PASS = os.getenv('DB_PASSWORD')
DB_NAME = os.getenv('DB_NAME')

DATABASE_URL = f"postgresql://{DB_USER}:{DB_PASS}@{DB_HOST}/{DB_NAME}"

4. High Entropy Strings

🟡 MEDIUM
  📄 src/utils/crypto.js:15
     High entropy string detected (potential secret)
     const key = "x7K9mP2nQ8vL4wR6tY3zA1bC5dE0fG"

     💡 Recommendation: If this is a secret, move to secure storage

What it means:

String has high randomness (entropy > 4.5)
Likely a generated secret or token
May be a legitimate random value

How to evaluate:

Is it a secret? → Move to env var or vault
Is it a hash? → OK to keep if public
Is it a test fixture? → Add comment explaining

Action Priority Matrix

Grade	Critical	High	Medium	Low	Action
F	2+	Any	Any	Any	🚨 Emergency fix
D	1-2	2+	Any	Any	⚠️ Immediate action
C-	1	1+	Any	Any	⚠️ Fix before deploy
C/C+	0	1-2	5+	Any	⚠️ Address soon
B-/B/B+	0	0-1	1-5	Any	ℹ️ Plan fixes
A-/A/A+	0	0	0-1	1-10	✅ Optional cleanup

False Positives

Sometimes KafkaCode may flag non-issues:

Example 1: Test Data

// ⚠️ Flagged as Medium (email)
const testEmail = "test@example.com";

// ✅ Add context to reduce false positive
const TEST_EMAIL = "test@example.com"; // Test data only, not real PII

Example 2: Public Information

# ⚠️ Flagged as Low (URL)
PUBLIC_API = "https://api.example.com/public"

# ✅ This is acceptable - public endpoint
# No action needed

Example 3: Placeholder Values

// ⚠️ Flagged as High (API key pattern)
String apiKey = "your-api-key-here";  // Placeholder

// ✅ Better: Use a clearly fake value
String apiKey = "REPLACE_WITH_YOUR_API_KEY";

How to handle:

Review the context
Determine if it’s a real issue
If false positive, add a comment
Consider refactoring for clarity

Report Examples

Clean Project (A+)

📊 SCAN SUMMARY
📄 Files Scanned: 50
🔍 Total Issues: 0
🏆 Privacy Grade: 🟢 A+

✅ No privacy issues detected!

Interpretation: Perfect! Safe for production.

Minor Issues (A-)

📊 SCAN SUMMARY
📄 Files Scanned: 50
🔍 Total Issues: 2
🏆 Privacy Grade: 🟢 A-

🔵 LOW (2)
  📄 src/config.js:8
     IP address: "192.168.1.1"

Interpretation: Very good. Optional cleanup of IP addresses.

Moderate Concerns (C)

📊 SCAN SUMMARY
📄 Files Scanned: 50
🔍 Total Issues: 15
🏆 Privacy Grade: 🟡 C

🔴 CRITICAL (1)
  📄 src/db.js:5
     Database password

🟠 HIGH (2)
  📄 API keys detected

🟡 MEDIUM (8)
  📄 Multiple PII leaks

🔵 LOW (4)
  📄 Various configuration issues

Interpretation: Not production-ready. Fix critical/high issues immediately.

Critical Problems (F)

📊 SCAN SUMMARY
📄 Files Scanned: 50
🔍 Total Issues: 25
🏆 Privacy Grade: 🔴 F

🔴 CRITICAL (5)
  📄 Multiple exposed secrets

🟠 HIGH (8)
  📄 Extensive API key exposure

🟡 MEDIUM (10)
  📄 Widespread PII issues

🔵 LOW (2)

Interpretation: Emergency. Complete security audit needed. Block all deployments.

Next Steps

CI/CD Integration

Automate scanning in your pipeline

Privacy Grading

Deep dive into the grading system

Detection Methods

Understand what’s being detected

Examples

See real-world examples

Get Started

Core Concepts

Usage Guide

Advanced

Interpreting Results

Report Structure

Understanding the Scan Summary

Key Metrics Explained

Privacy Grade Interpretation

🟢 A+ / A / A-

🔵 B+ / B / B-

🟡 C+ / C / C-

🔴 D / F

Reading Issue Listings

Critical Issues 🔴

High Severity Issues 🟠

Medium Severity Issues 🟡

Low Severity Issues 🔵

Common Issue Types

1. Hardcoded Secrets

2. PII in Code

3. Connection Strings

4. High Entropy Strings

Action Priority Matrix

False Positives

Example 1: Test Data

Example 2: Public Information

Example 3: Placeholder Values

Report Examples

Clean Project (A+)

Minor Issues (A-)

Moderate Concerns (C)

Critical Problems (F)

Next Steps

CI/CD Integration

Privacy Grading

Detection Methods

Examples

​Report Structure

​Understanding the Scan Summary

​Key Metrics Explained

​Privacy Grade Interpretation

🟢 A+ / A / A-

🔵 B+ / B / B-

🟡 C+ / C / C-

🔴 D / F

​Reading Issue Listings

​Critical Issues 🔴

​High Severity Issues 🟠

​Medium Severity Issues 🟡

​Low Severity Issues 🔵

​Common Issue Types

​1. Hardcoded Secrets

​2. PII in Code

​3. Connection Strings

​4. High Entropy Strings

​Action Priority Matrix

​False Positives

​Example 1: Test Data

​Example 2: Public Information

​Example 3: Placeholder Values

​Report Examples

​Clean Project (A+)

​Minor Issues (A-)

​Moderate Concerns (C)

​Critical Problems (F)

​Next Steps

CI/CD Integration

Privacy Grading

Detection Methods

Examples

Report Structure

Understanding the Scan Summary

Key Metrics Explained

Privacy Grade Interpretation

Reading Issue Listings

Critical Issues 🔴

High Severity Issues 🟠

Medium Severity Issues 🟡

Low Severity Issues 🔵

Common Issue Types

1. Hardcoded Secrets

2. PII in Code

3. Connection Strings

4. High Entropy Strings

Action Priority Matrix

False Positives

Example 1: Test Data

Example 2: Public Information

Example 3: Placeholder Values

Report Examples

Clean Project (A+)

Minor Issues (A-)

Moderate Concerns (C)

Critical Problems (F)

Next Steps