PII inventory
fields holding names, emails, phones, government ids, location, health, financial data; where they are stored and for how long.
The pack · 06 / 14 →
Privacy
Beagle
the privacy dog. Follows personal data into logs, analytics and SDKs. Maps findings to GDPR and India's DPDP Act.
signup.ts
12export async function signup(user: User) {
13 await db.users.create(user);
14 logger.info("new user", user); logger.info("new user", { id: user.id });
15 analytics.track("signup", user);
16}
Personal data in logs
ExploitEmails and phone numbers land in your log vendor
FixSmallest change suggested
Beagle is watching$ /watchdog-go-privacy0 found · 0 fixed
What it does
On duty while you build.
The privacy dog. Sniffs out personal data flowing into logs, analytics, third-party SDKs and storage, and maps findings to GDPR and India's DPDP Act.
The always-on lens watches personal data, PII, logging, analytics, SDKs, consent, data retention, GDPR, DPDP.
What it checks
7 things Beagle looks for.
Leaks to logs and traces
request/response bodies, user objects or tokens logged; error trackers capturing PII.
Third parties
analytics, ads and crash SDKs receiving PII or device ids; data sent cross-border.
Consent
tracking that fires before consent; no way to withdraw.
Retention and deletion
no TTL or purge; account deletion that leaves copies in backups, caches, search indexes.
Minimisation
APIs and exports returning more personal data than the screen needs; PII in URLs.
Rights
no path to export or delete a user's data (GDPR Art. 15/17, DPDP s.11-13).
Commands
Send Beagle out.
Runs these scanners when installed, then reads the code they can't understand:
- semgrep
Personal data in code, logs, analytics and SDKs; retention; consent; GDPR/DPDP mapping
- /watchdog-go-ai-app
- /watchdog-go-marketplace
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds a fitness-app Express API and web page with 18 planted privacy issues, 3 decoys and an answer key.
found
Haiku 5.517/18
Sonnet 5.518/18
Opus 5.518/18
Rules of engagement
What Beagle will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Beagle, answered.
What does Beagle check for?
Beagle is Watchdog's privacy dog for Claude Code. It looks for PII inventory, Leaks to logs and traces, Third parties, Consent, Retention and deletion, Minimisation and Rights. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Beagle in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-privacy. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Beagle use?
When they're installed, Beagle runs semgrep, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Beagle safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).