Examples
Real fixes, side by side.
Common issues RuleFix detects and the patches it proposes. Switch between Before and After on each example.
- DPDPGDPR
Capture consent at signup
Personal data was stored without a record of consent. The fix stores consent, its timestamp and the policy version.
app/api/signup.tsawait db.user.create({ data: { email, name, consentGiven: true, consentTimestamp: new Date(), consentVersion: PRIVACY_POLICY_VERSION, }, }); - GDPRISO 27001
Redact personal data in logs
An email address was written to application logs. The fix logs a stable, non-reversible identifier instead.
services/auth.pyfrom app.privacy import pseudonymize logger.info("login failed for %s", pseudonymize(user.email)) - PCI DSS
Never store card security codes
The CVV was persisted after authorisation. The fix tokenises the card with the payment provider and stores only the token.
app/api/checkout.tsconst { token, last4 } = await payments.tokenize({ cardNumber, cvv, expiry }); await db.payment.create({ data: { cardToken: token, last4, userId }, }); - DPDPLGPD
Enforce a retention period
Inactive accounts were kept indefinitely. The fix adds a scheduled job that erases data once its purpose is served.
jobs/retention.tsexport const retention = cron("0 3 * * *", async () => { const cutoff = subMonths(new Date(), RETENTION_MONTHS); await db.user.deleteMany({ where: { lastActiveAt: { lt: cutoff }, legalHold: false }, }); });
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.