update

nocomplexity · nocomplexity · commit 1227b89813c4 · 2026-03-12T15:38:42.000+01:00
diff --git a/security/data_exfiltration_detection.md b/security/data_exfiltration_detection.md
@@ -5,7 +5,7 @@ Detecting potential data exfiltration caused by Python programs is important.
 :::{danger} 
 Detecting Data Exfiltration in Python Code that Uses Telemetry, Remote Analytics, and SaaS Integrations
 
-An essential step in **mitigating security risks**.
+This is an essential step in **mitigating security risks**.
 :::
 
 
@@ -73,6 +73,6 @@ Every external API endpoint is a potential point of failure.
 
 Data sent to a third party is only as secure as their defenses.
 
-- Loss of Custody: Once data leaves your perimeter, you lose the ability to protect it.
+- **Loss of Custody**: Once data leaves your perimeter, you lose the ability to protect it.
 - **Transparency Gaps:** You are dependent on the provider to detect and report breaches—a process that often takes months.
 
diff --git a/security/howto_detect_data_egress.md b/security/howto_detect_data_egress.md
@@ -1,33 +1,24 @@
 # How to Check for Data Exfiltration
 
-**[Python Code Audit](https://nocomplexity.com/codeaudit/)** includes functionality to detect potential data exfiltration risks. This feature is available through:
+## The Challenge
 
-- the [CLI interface](userguide), and
+Modern Python applications often interact with external services such as logging platforms, cloud APIs, analytics systems, and AI services. While these integrations provide valuable functionality, they can also introduce data exfiltration risks.
 
-- the [API](apidocs/modules).
+Data exfiltration occurs when sensitive information leaves the application and is transmitted to external systems without proper controls.
 
-Using the CLI
+Examples include:
 
-The egress detection function can be activated with the following command:
-```bash
-codeaudit filescan <pythonfile|package-name|directory> [OUTPUTFILE]
-```
+- Sending application data to external monitoring services
 
-**Report Output**
+- Transmitting logs containing sensitive metadata
 
-In the generated HTML report, each analysed file is evaluated for potential data exfiltration to external services.
-
-If a potential risk is detected, the report will display:
-> *&#9888;&#65039; External Egress Risk: Detected outbound connection logic or API keys that may facilitate data egress.*
+- Uploading files to cloud storage services
 
-The report also highlights the exact lines of code that triggered the detection.
+- Sending prompts or data to external AI APIs
 
-If no external egress risks are identified, the report will display:
-> *&#x2705; No logic for connecting to remote services found. Risk of data exfiltration to external systems is low.*
+## The Threat
 
-:::{important} 
-No tool can provide 100% guarantees. This applies to Python Code Audit as well as to any other security analysis tool.
-:::
+External service integrations can expose applications to several security risks depending on the type of service used.
 
 Data egress exposes Python applications to a wide range of security threats and risks:
 
@@ -41,6 +32,55 @@ Data egress exposes Python applications to a wide range of security threats and
 | Communication Gateways   | Financial Risk / Phishing | Twilio, SendGrid, Slack Webhooks| 🔴 High   |
 
 
+## Vulnerable Code Example
+
+A common source of data exfiltration risk is code that sends application data to external services without proper validation or filtering.
+
+```python
+import requests
+import os
+
+API_KEY = os.getenv("API_KEY")
+
+def send_user_data(user_data):
+    url = "https://external-service.example/api/upload"
+    
+    payload = {
+        "api_key": API_KEY,
+        "data": user_data
+    }
+
+    requests.post(url, json=payload)
+```
+
+Why this is risky
+
+This code transmits potentially sensitive information to an external API:
+
+- User data is sent without validation
+
+- External endpoint communication is hardcoded
+
+- API credentials are used directly
+
+- There is no monitoring or restriction of outbound traffic
+
+[Python Code Audit](https://nocomplexity.com/codeaudit/) (and some other SAST tools)  can detect these patterns and flag them as potential egress risks.
+
+
+## Secure Mitigation
+
+To mitigate these risks, security reviewers must flag and investigate all outbound logic. Using the Python Code Audit CLI, you can audit your files or packages with a single command when using Python Code Audit. Python Code Audit includes an egress detection feature that scans source code for potential outbound communication and external service integrations.
+
+Use the following command:
+
+```bash
+codeaudit filescan <pythonfile|package-name|directory> [OUTPUTFILE]
+```
+
+The tool analyzes the specified file, package, or directory and generates an HTML security report.
+
+
 :::{admonition} High-risk integrations are a key focus for [Python Code Audit](https://nocomplexity.com/codeaudit/) egress detection!
 :class: danger, dropdown
 
@@ -56,3 +96,77 @@ The following categories represent common classes of external service integratio
 
 :::
 
+
+Interpreting the Results
+The generated HTML report provides immediate feedback on your egress posture:
+
+
+If a potential risk is detected, the report will display:
+> *&#9888;&#65039; External Egress Risk: Detected outbound connection logic or API keys that may facilitate data egress.*
+
+The report also highlights the exact lines of code that triggered the detection.
+
+If no external egress risks are identified, the report will display:
+> *&#x2705; No logic for connecting to remote services found. Risk of data exfiltration to external systems is low.*
+
+
+To reduce the risk of data exfiltration, apply the following security practices.
+
+**1 .Restrict outbound communication**
+
+Limit which services your application can contact.
+
+Examples:
+
+- Adjust or improve the Python Code!
+- Network egress filtering
+
+- Firewall rules
+
+- API allowlists
+
+**2. Avoid sending sensitive data externally**
+
+Ensure that external APIs do not receive:
+
+- Personal data
+
+- Secrets / Credentials
+
+- Internal system metadata
+
+- Implement data filtering and redaction before transmission.
+
+:::{important} 
+No tool can provide 100% guarantees. This applies to Python Code Audit as well as to any other security analysis tool.
+:::
+
+## Discussion
+
+Detecting potential data exfiltration paths is an important part of secure software development.
+
+While external integrations are often necessary, they must be carefully reviewed to ensure:
+
+- sensitive data is not transmitted unintentionally
+
+- credentials are handled securely
+
+- outbound communication is controlled
+
+- third-party services are trusted and properly configured
+
+Automated analysis tools such as Python Code Audit help developers and security teams identify these risks early in the development lifecycle.
+
+However, automated scanning should always be combined with:
+
+- manual code reviews
+
+- architecture analysis
+
+- runtime monitoring
+
+Together, these practices significantly reduce the risk of unintentional data leakage from Python applications.
+
+
+------
+
