Due 2025Q1

The Host Based Inventory (HBI) service added a feature to avoid potential future data leaks by checking outgoing response data (systems) had the same org_id value as the user making the request. In this case the API response form HBI contains the associated org_id.

Cyndi applications also have access to systems data and we want to avoid a leak there:

• Advisor (python; django)
• Compliance (ruby)
• Malware-detection (golang)
• Patch (golang)
• Vulnerability (python; connexion)

All other applications make an API call to Host Based Inventory, as such are utilizing the org_id protection call embedded in that service. However, if these services maintain any organization specific information not tied to systems being analyzed those should also be evaluated.

Acceptance Criteria

1. Review your service to see if there is any PII or other sensitive information that is handled that could potentially be leaked (via API responses in particular, though other possible ways of leaking data should be considered).  If there is no potential for a leak, state so in the Jira issue and close it out stating it is not applicable.
2. For any sensitive data that could potentially be leaked, review how your service currently protects against leakage and consider if there are additional safeguards that make sense to implement.  Review the attached “avoiding data leaks” document for possible approaches and inspiration.  If you feel sensitive data is sufficiently protected already, describe how it is protected and close out the issue for your service.
3. If additional protection against data leaks make sense and are possible to implement, either do so as a part of the issue for your service if it is simple, or file a new separate issue with details on what is needed so it can be prioritized in a future iteration.