I Made Two Repos Public and Then Panic-Scanned Them for Personal Data Leaks
The 2 AM Decision
I was staring at two GitLab repos — my entire capstone project, months of code, documentation, and deliverables — with the visibility toggle set to private.
Tomorrow they go public. But before I flip that switch, one question kept nagging me: did I accidentally leave my NRIC in a comment somewhere?
Singapore’s PDPA (Personal Data Protection Act) doesn’t mess around. If you’re publishing code that might contain personal data, you need to know exactly what’s exposed.
So I did what any paranoid developer would do — I automated the audit.
What I Scanned
Two repositories, both going public:
| Repo | Contents | Risk |
|---|---|---|
lithan-capstone-project |
Full-stack app, reports | High |
lithan-capstone-project-sha1 |
SHA-256 mirror | High |
The scanner? My own pdpa-sg-clj — a Babashka-based PII scanner built for Singapore PDPA compliance.
The PDPA Categories That Matter
Under Singapore’s PDPA, personal data is any data about an individual who can be identified from that data alone.
Identity & Contact:
| Category | Protected? |
|---|---|
| NRIC/FIN Numbers | Yes — primary target |
| Full Names | Yes — when paired |
| Phone Numbers | Yes |
| Email (Personal) | Yes |
| Email (Business) | No — BCI exclusion |
Location, Financial & Health:
| Category | Protected? |
|---|---|
| Residential Address | Yes |
| Financial Data | Yes |
| Health Records | Yes |
| Biometric Data | Yes |
| Digital Identifiers | Yes — when linkable |
What I Actually Found
No Critical Leaks
Zero NRIC numbers. Zero phone numbers. Zero residential addresses. Zero financial or health data.
The repos are clean on the hard stuff.
Minor Finding #1: Professional Email
"Designed and engineered by Nur Azhar (career@nurazhar.com)"My professional email sits in the /llms.txt endpoint.
Under PDPA, this is Business Contact Information (BCI)
— explicitly excluded from protection. Verdict:
Safe.
Minor Finding #2: Northflank Account ID
"vcsAccountId": "6a51af90ecdfaed00c8157fc"Looks scary but isn’t. It’s an opaque UUID — a resource identifier, not a secret.
It can’t authenticate, access, or modify anything. Northflank’s API requires a separate API key for any action. Verdict: Safe.
Minor Finding #3: Local File Paths
file:///home/nurazhar/Work/bootcamp/Capstone_Project/...Several markdown files reference my local filesystem paths. Not PDPA-relevant, but reveals my Linux username. Verdict: Cosmetic only.
The Full Scan Results
Identity & Contact:
| Category | Result |
|---|---|
| NRIC/FIN | ✅ None |
| Phone Numbers | ✅ None |
| Email (Personal) | ✅ None |
| Email (Business) | ✅ BCI Excluded |
Location, Financial & Health:
| Category | Result |
|---|---|
| Residential Address | ✅ None |
| Financial Data | ✅ None |
| Health Records | ✅ None |
| Biometric Data | ✅ None |
Infrastructure:
| Category | Result |
|---|---|
| Digital Identifiers | ✅ Not a secret |
| Local File Paths | ✅ Not PDPA data |
Why This Matters for Solo Developers
If you’re a solo developer in Singapore making repos public:
- Run a PII scanner before flipping visibility — don’t eyeball it
- Know the PDPA categories — NRIC, phone, address, financial, health, biometric
- Understand BCI exclusion — business email is not personal data if used professionally
- Check deployment configs — service account IDs look scary but usually aren’t secrets
- Audit documentation — markdown files often contain more PII than code
The entire audit took about 5 minutes with automated tooling. The peace of mind is worth hours.
The Takeaway
Automated PDPA compliance scanning before publishing is not optional — it’s a 5-minute habit that prevents a 5-figure fine.