doncheli-data-policy-ac8d61 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited doncheli-data-policy-ac8d61 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
--generate-notice).dc/data-policy-audit-<date>.md## Data Policy Audit — 2026-03-28
### Data Inventory
| Field | Model | Purpose | Retention | Shared With |
|-----------|-----------|---------------|-----------|----------------|
| email | User | Auth, comms | Indefinite| SendGrid, Auth0|
| ip_address| AuditLog | Security | 90 days | Internal only |
### Compliance Gaps
🔴 CRITICAL: ip_address logged in plain text in audit_logs — encrypt or hash
🟡 WARNING: No data retention policy enforced for User.email — GDPR Art. 5(e)
🟢 INFO: No right-to-erasure endpoint found — required for GDPR compliance
### Recommendations
1. Add @Encrypted() decorator to ip_address field
2. Implement DELETE /users/:id endpoint that purges all PII
3. Document data retention in Privacy Policy~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.