VenusOne-Lee/popia-compliance

contact_links:   - name: Security vulnerability in this project     url: https://github.com/VenusOne-Lee/popia-compliance/security/advisories/new

- name: Security vulnerability in this project     url: https://github.com/VenusOne-Lee/popia-compliance/security/advisories/new     about: Please report vulnerabilities privately.

url: https://github.com/VenusOne-Lee/popia-compliance/security/advisories/new

Please read [the reviewer terms in GOVERNANCE.md](https://github.com/VenusOne-Lee/popia-compliance/blob/main/GOVERNANCE.md#reviewer-terms) first. In short: your review is not legal advice to users and creates no client relationship.

run: sudo -E env "PATH=$PATH" bash tests/supabase/run_live.sh

run: sudo -E bash tests/sql/run_sql_tests.sh

environment:       name: pypi       url: https://pypi.org/project/popia-kit/

name: pypi       url: https://pypi.org/project/popia-kit/     permissions:

url: https://pypi.org/project/popia-kit/

run: rm -f dist/*.tgz

environment:       name: npm       url: https://www.npmjs.com/package/popia-kit

name: npm       url: https://www.npmjs.com/package/popia-kit     permissions:

url: https://www.npmjs.com/package/popia-kit

with:           node-version: "22"           registry-url: "https://registry.npmjs.org"

registry-url: "https://registry.npmjs.org"

[Credential-related source omitted]

[Credential-related source omitted]

### Added - Release workflow: a version tag publishes to PyPI and npm with trusted publishing and npm provenance, then creates a GitHub release. Setup in docs/releasing.md. - One-line install, no clone needed: `uvx --from git+https://github

- Release workflow: a version tag publishes to PyPI and npm with trusted publishing and npm provenance, then creates a GitHub release. Setup in docs/releasing.md. - One-line install, no clone needed: `uvx --from git+https://github.com/Venus

- One-line install, no clone needed: `uvx --from git+https://github.com/VenusOne-Lee/popia-compliance popia-kit scan .`, the `pipx run` equivalent, or `npx -y github:VenusOne-Lee/popia-compliance scan .`. One `popia-kit` command with `scan`

- MCP server: unexpected errors return and log the exception type only; `popia_scan` refuses filesystem roots, the home folder and credential or system folders (optionally limited further with `POPIA_SCAN_ROOTS`); `popia_generate_pack` writ

- Scanner: no longer follows symlinks out of the scanned tree. - Fleet scan: clones only `https://` or `git@host:` URLs, separates the URL with `--`, disables hooks, submodules, LFS smudge and the file and ext transports, and redacts tokens

- Fleet scan: clones only `https://` or `git@host:` URLs, separates the URL with `--`, disables hooks, submodules, LFS smudge and the file and ext transports, and redacts tokens from clone errors.

This project adopts the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).

**To volunteer:** email **popiakit@venusone.africa**, or, if you're on GitHub, open a [Legal reviewer: volunteer](https://github.com/VenusOne-Lee/popia-compliance/issues/new?template=legal-reviewer.yml) issue (that issue is public).

Suggested attribution:   "Based on the POPIA Compliance Skill by Venus One (Venus ARC (Pty) Ltd) and contributors,    https://github.com/VenusOne-Lee/popia-compliance, licensed under CC BY 4.0."

https://github.com/VenusOne-Lee/popia-compliance, licensed under CC BY 4.0."

Full legal code: https://creativecommons.org/licenses/by/4.0/legalcode

[![PyPI](https://img.shields.io/pypi/v/popia-kit)](https://pypi.org/project/popia-kit/) [![CI](https://github.com/VenusOne-Lee/popia-compliance/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/VenusOne-Lee/popia-complianc

**No install:** check a live site you own in your browser at [popiakit.co.za/check](https://popiakit.co.za/check). It runs the same passive site check as `popia-kit site-check`, and you can download the report as a PDF. Project site: [popia

Python 3.8 or newer and nothing else. No install needed: run it from [PyPI](https://pypi.org/project/popia-kit/) with whichever tool you already have.

To keep it installed: `pipx install popia-kit`, then use `popia-kit` anywhere. For the latest code on `main`, use `uvx --from git+https://github.com/VenusOne-Lee/popia-compliance popia-kit scan .`

| `popia-kit scan . --changed-since origin/main` | Report only findings in files changed since a branch | | `popia-kit operators ./my-app --format csv --out operators.csv` | Every third-party API or SDK the code calls, and the personal info

| `popia-kit operators ./my-app --format csv --out operators.csv` | Every third-party API or SDK the code calls, and the personal information that appears to reach each. Your operator and cross-border list | | `popia-kit site-check https://

| `popia-kit site-check https://example.co.za --out site-check.md` | Passive check of a live site you own |

git clone https://github.com/VenusOne-Lee/popia-compliance

- **Report a law change:** open a [law-change issue](.github/ISSUE_TEMPLATE/law-change.yml). A monthly automated watch of the Regulator's site opens these too. - **Report a false positive:** open a [false positive issue](.github/ISSUE_TEMPL

- **Report a false positive:** open a [false positive issue](.github/ISSUE_TEMPLATE/false-positive.yml) with the rule ID and a small example. - **First time here:** look for issues labelled [good first issue](https://github.com/VenusOne-Lee

- **First time here:** look for issues labelled [good first issue](https://github.com/VenusOne-Lee/popia-compliance/labels/good%20first%20issue).

python3 scripts/site_check.py https://example.co.za --out site-check.md

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

The same query and rules ship as `uvx popia-kit supabase sql` and `uvx popia-kit supabase check result.json`. For the live site, use the free passive check at https://popiakit.co.za/check.

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

Full skill, scanner and references: https://github.com/VenusOne-Lee/popia-compliance

#!/usr/bin/env node

process.exit(r.status === null ? 1 : r.status); } console.error('popia-kit needs Python 3.8 or newer. Install it from https://www.python.org/downloads/ and try again.');

} console.error('popia-kit needs Python 3.8 or newer. Install it from https://www.python.org/downloads/ and try again.'); process.exit(1);

console.error('popia-kit needs Python 3.8 or newer. Install it from https://www.python.org/downloads/ and try again.');

repos:   - repo: https://github.com/VenusOne-Lee/popia-compliance

- repo: https://github.com/VenusOne-Lee/popia-compliance

https://github.com/your-org/lovable-project-one.git

https://github.com/your-org/lovable-project-two.git

`--shields-json` writes a [shields.io endpoint](https://shields.io/badges/endpoint-badge) file. Commit it (or publish it from CI to a branch or Pages) and use:

![POPIA scan](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/OWNER/REPO/BRANCH/popia-badge.json)

[Credential-related source omitted]

Only want to check a live site? Use [popiakit.co.za/check](https://popiakit.co.za/check) in your browser. Nothing to install.

R=https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r

uvx popia-kit site-check https://your-site.co.za --out site-check.md

`server.json` describes the MCP server for the [official MCP Registry](https://registry.modelcontextprotocol.io), which Claude, Cursor, VS Code and other clients use to find servers. The registry checks that the PyPI package is ours by find

2. From the repository root on `main`: `mcp-publisher login github`. Sign in as VenusOne-Lee in the browser. 3. `mcp-publisher publish`. It reads `server.json`. 4. Check it is listed: `curl "https://registry.modelcontextprotocol.io/v0/serve

4. Check it is listed: `curl "https://registry.modelcontextprotocol.io/v0/servers?search=popia-kit"`.

The POPIA Kit site check looks at a live website for privacy and security leads: HTTPS, security headers, cookies set before consent, trackers and links to a privacy notice and PAIA manual. Someone ran it on your site, either at [popiakit.c

popia-site-check/1.0 (+https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/site-check-bot.md; passive)

- The page that was entered, following up to 5 redirects. - `http://` on the same host, without following the redirect, to see whether plain HTTP sends visitors to HTTPS.

- `http://` on the same host, without following the redirect, to see whether plain HTTP sends visitors to HTTPS.

- Run the check yourself from a network you already trust: `uvx popia-kit site-check https://your-site.co.za`

[Credential-related source omitted]

[Credential-related source omitted]

# Any OpenAI-compatible server (Ollama, vLLM, LM Studio, OpenRouter, Azure-style gateways) export OPENAI_COMPATIBLE_BASE_URL=http://localhost:11434   # /v1/chat/completions is appended

export OPENAI_COMPATIBLE_BASE_URL=http://localhost:11434   # /v1/chat/completions is appended

Executable file

prompt = f"Customer record: {json.dumps(customer)}\nQuestion: {question}"     body = json.dumps({"model": "some-model", "messages": [{"role": "user", "content": prompt}]}).encode()     req = urllib.request.Request("https://api.example-llm.c

body = json.dumps({"model": "some-model", "messages": [{"role": "user", "content": prompt}]}).encode()     req = urllib.request.Request("https://api.example-llm.com/v1/chat/completions", data=body,                                  headers={

req = urllib.request.Request("https://api.example-llm.com/v1/chat/completions", data=body,

headers={"content-type": "application/json"})     resp = urllib.request.urlopen(req).read()     with open("transcripts.log", "a") as f:          # kept forever

resp = urllib.request.urlopen(req).read()

# FAKE EVAL FIXTURE. Represents a committed .env.local file. Values are synthetic placeholders, not credentials. VITE_SUPABASE_URL=https://fakeevalfixture000.supabase.co

VITE_SUPABASE_URL=https://fakeevalfixture000.supabase.co

Executable file

[Credential-related source omitted]

<!-- FAKE EVAL FIXTURE --> <script async src="https://www.googletagmanager.com/gtag/js?id=G-FAKE000000"></script>

<script async src="https://www.googletagmanager.com/gtag/js?id=G-FAKE000000"></script>

gtag('js', new Date());   gtag('config', 'G-FAKE000000');   !function(f,b,e,v,n,t,s){}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');

gtag('config', 'G-FAKE000000');   !function(f,b,e,v,n,t,s){}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');   fbq('init', '000000000000000');

!function(f,b,e,v,n,t,s){}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');

Executable file

Executable file

Executable file

Executable file

<!-- FAKE EVAL FIXTURE --> <script async src="https://www.googletagmanager.com/gtag/js?id=G-FAKE000000"></script>

<script async src="https://www.googletagmanager.com/gtag/js?id=G-FAKE000000"></script>

gtag('js', new Date());   gtag('config', 'G-FAKE000000');   !function(f,b,e,v,n,t,s){}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');

gtag('config', 'G-FAKE000000');   !function(f,b,e,v,n,t,s){}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');   fbq('init', '000000000000000');

!function(f,b,e,v,n,t,s){}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');

Executable file

[Credential-related source omitted]

"references/06-cross-border-and-operators.md"       ],       "answer": "# Order-support bot: improved, and made POPIA-safe\n\nThe current bot sends the **entire customer record** to a US-hosted LLM on every question. That includes the **SA 

],       "answer": "# Order-support bot: improved, and made POPIA-safe\n\nThe current bot sends the **entire customer record** to a US-hosted LLM on every question. That includes the **SA ID number, bank account number, email, phone and com

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

OPENAI_COMPATIBLE_BASE_URL                for --provider openai-compatible (e.g. http://localhost:11434)

[Credential-related source omitted]

last = None     for attempt in range(retries + 1):         req = urllib.request.Request(url, data=data, headers=headers, method="POST")

for attempt in range(retries + 1):         req = urllib.request.Request(url, data=data, headers=headers, method="POST")         try:

req = urllib.request.Request(url, data=data, headers=headers, method="POST")

with urllib.request.urlopen(req, timeout=timeout) as resp:  # nosec B310

[Credential-related source omitted]

[Credential-related source omitted]

if temperature is not None:             body["temperature"] = temperature         res = _post("https://api.anthropic.com/v1/messages",

[Credential-related source omitted]

res = _post("https://api.anthropic.com/v1/messages",

if provider == "openai":             key = os.environ.get("OPENAI_API_KEY")             base = os.environ.get("OPENAI_BASE_URL", "https://api.openai.com")

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

with:           scan: "false"           site-url: https://example.co.za/

scan: "false"           site-url: https://example.co.za/           site-fail-on: high

site-url: https://example.co.za/

{ "url": "https://example.co.za", "turnstileToken": "<token from the widget>" }

A URL without a scheme gets `https://`. A successful response is HTTP 200:

{   "url": "https://example.co.za/",

"url": "https://example.co.za/",

"final_url": "https://www.example.co.za/",

| Name | Required | Default | Purpose | |---|---|---|---| | `ALLOWED_ORIGINS` | yes | none | Comma separated list of exact origins, for example `https://venusone.co.za,https://www.venusone.co.za`. Requests without an allowed `Origin` get 40

|---|---|---|---| | `ALLOWED_ORIGINS` | yes | none | Comma separated list of exact origins, for example `https://venusone.co.za,https://www.venusone.co.za`. Requests without an allowed `Origin` get 403. Empty means everything is refused. | 

| `ALLOWED_ORIGINS` | yes | none | Comma separated list of exact origins, for example `https://venusone.co.za,https://www.venusone.co.za`. Requests without an allowed `Origin` get 403. Empty means everything is refused. |

supabase secrets set ALLOWED_ORIGINS="https://venusone.co.za,https://www.venusone.co.za" \

const res = await fetch("https://<ref>.supabase.co/functions/v1/site-check", {

curl -s -X POST https://<ref>.supabase.co/functions/v1/site-check \

-H 'origin: https://venusone.co.za' -H 'content-type: application/json' \

Every request the function makes to the target goes through one guarded fetch. That covers the main page, every redirect hop, the `http://` redirect probe, `/.well-known/security.txt` and the optional notice paths.

1. Parse with the WHATWG URL parser. It normalises tricks like `http://2130706433/`, `http://0x7f.1/` and `http://127.1/` into dotted quads, so they are caught.

- Only `text/html` bodies are parsed, capped at 1.5 MB (Python read 2,000,000 bytes of any type). - Cookies are parsed with browser rules (RFC 6265) instead of `SimpleCookie`. Results match on the Python test cases. - `max-age` in HSTS and 

[Credential-related source omitted]

[Credential-related source omitted]

- `max-age` in HSTS and `http://` in script sources are matched case-insensitively.

Executable file

Executable file

"node_modules/@supabase/auth-js": {       "version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.118.0.tgz",

"version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.118.0.tgz",       "integrity": "sha512-xWfPXyhS2KDSfAneMtI6p/tBnbdiz/5vaRKXEqUfzfC9WCniKr2Ds5o5G7RIGig0bom4z6wUY9zaV07WDVTfnQ==",

"resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.118.0.tgz",

"node_modules/@supabase/functions-js": {       "version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.118.0.tgz",

"version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.118.0.tgz",       "integrity": "sha512-4ofletPa/noKAU6KHeqsd3FztGzRPUEJRey1MKY0o+PIHaVePqRPShIXtl37gcVyIWaFM+zNg6r9zh0uUSFOSA==",

"resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.118.0.tgz",

"node_modules/@supabase/phoenix": {       "version": "0.4.5",       "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.5.tgz",

"version": "0.4.5",       "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.5.tgz",       "integrity": "sha512-aAn9H9ovVyeApKy11OWOrrOGq8DV68yWeH4ud2lN9fzn4aO8Zb5GLL9m1pUg9nLqIcT+ZDfAcsZe0E/nqdv2lw==",

"resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.5.tgz",

"node_modules/@supabase/postgrest-js": {       "version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.118.0.tgz",

"version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.118.0.tgz",       "integrity": "sha512-JXy+37KPApHsyotaQACovv/Jy9E22rfiWLRuT+2UjoEAcAIelDFIrsF/FY47Dy19mO7lI0Tq+zDCX8oJ2Ozfiw==",

"resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.118.0.tgz",

"node_modules/@supabase/realtime-js": {       "version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.118.0.tgz",

"version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.118.0.tgz",       "integrity": "sha512-pzCIEWjqD5/xqEZQerpt+q9rsgYkcrkgCJgf0W2ULqC4fYUeB/p9CFa3t9vn+IVh6dMN9r4ZCE262lZvUC+Bfw==",

"resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.118.0.tgz",

"node_modules/@supabase/storage-js": {       "version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.118.0.tgz",

"version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.118.0.tgz",       "integrity": "sha512-5MNkKt2Moy7Jud/sPX7/28BwdDxZMCVHGJT00b8op3KRa9LKSjOAYU5IcfGWIstaasAqY8GkbA6oI3IRDgB1YQ==",

"resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.118.0.tgz",

"node_modules/@supabase/supabase-js": {       "version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.118.0.tgz",

"version": "2.118.0",       "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.118.0.tgz",       "integrity": "sha512-FxI8UXMVC2UG7IkeiI8fuQZqq2oI3JeSuN8MPIC2RLVaoEAxKS0nqE6kii9Ewpq8f9gNPM6git1Y8f0vN/QLFw==",

"resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.118.0.tgz",

"node_modules/@types/node": {       "version": "20.19.43",       "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",

"version": "20.19.43",       "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",       "integrity": "sha512-6oYBAi5ikg4Pl+kGsoYtawUMBT2zZMCvPNF7pVLnHZfd1zf38DRiWn/gT01RYCdUqkv7Fhr+C9ot4/tb+2sVvA==",

"resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",

"node_modules/iceberg-js": {       "version": "0.8.1",       "resolved": "https://registry.npmjs.org/iceberg-js/-/iceberg-js-0.8.1.tgz",

"version": "0.8.1",       "resolved": "https://registry.npmjs.org/iceberg-js/-/iceberg-js-0.8.1.tgz",       "integrity": "sha512-1dhVQZXhcHje7798IVM+xoo/1ZdVfzOMIc8/rgVSijRK38EDqOJoGula9N/8ZI5RD8QTxNQtK/Gozpr+qUqRRA==",

"resolved": "https://registry.npmjs.org/iceberg-js/-/iceberg-js-0.8.1.tgz",

"node_modules/tslib": {       "version": "2.8.1",       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",

"version": "2.8.1",       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",

"resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",

"node_modules/undici": {       "version": "6.29.1",       "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",

"version": "6.29.1",       "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",       "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",

"resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",

"node_modules/undici-types": {       "version": "6.21.0",       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",

"version": "6.21.0",       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",       "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",

"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",

Executable file

Executable file

const ORIGIN = "https://check.venusone.co.za";

page.append("set-cookie", "_ga=1");   const routes: Record<string, () => Response> = {     "https://example.co.za/": () => new Response(`<a href="/privacy">Privacy</a>`, { headers: page }),

const routes: Record<string, () => Response> = {     "https://example.co.za/": () => new Response(`<a href="/privacy">Privacy</a>`, { headers: page }),   };

"https://example.co.za/": () => new Response(`<a href="/privacy">Privacy</a>`, { headers: page }),

});   const post = (url: string) =>     new Request("https://h/f", {

const post = (url: string) =>     new Request("https://h/f", {       method: "POST",

new Request("https://h/f", {

assert.deepEqual(body.cookies.map((c: { name: string }) => c.name), ["_ga"]);   assert.equal(keys.length, 2, "per-IP and global");   const blocked = await handler(post("http://169.254.169.254/latest/meta-data/"));

assert.equal(keys.length, 2, "per-IP and global");   const blocked = await handler(post("http://169.254.169.254/latest/meta-data/"));   assert.equal(blocked.status, 400);

const blocked = await handler(post("http://169.254.169.254/latest/meta-data/"));

const rebind: LookupFn = (_h, _o, cb) => cb(null, [{ address: "127.0.0.1", family: 4 }]);     const url = `http://rebind.example.co.za:${srv.port}/`;

const url = `http://rebind.example.co.za:${srv.port}/`;

return true;     });     await assert.rejects(createPinnedFetch()(`http://localhost:${srv.port}/`), TypeError, "system resolver answer refused");

});     await assert.rejects(createPinnedFetch()(`http://localhost:${srv.port}/`), TypeError, "system resolver answer refused");     await assert.rejects(createPinnedFetch()(`http://127.0.0.1:${srv.port}/`), TypeError, "IP literal refused")

await assert.rejects(createPinnedFetch()(`http://localhost:${srv.port}/`), TypeError, "system resolver answer refused");

await assert.rejects(createPinnedFetch()(`http://127.0.0.1:${srv.port}/`), TypeError, "IP literal refused");     await assert.rejects(createPinnedFetch()(`http://[::1]:${srv.port}/`), TypeError, "IPv6 literal refused");     assert.equal(srv

await assert.rejects(createPinnedFetch()(`http://[::1]:${srv.port}/`), TypeError, "IPv6 literal refused");     assert.equal(srv.hits.length, 1, "guarded requests never arrived");     await open.close();

try {     const env = (k: string) =>       ({ SUPABASE_URL: `http://127.0.0.1:${srv.port}`, SUPABASE_SERVICE_ROLE_KEY: "srk" } as Record<string, string>)[k];

const env = (k: string) =>       ({ SUPABASE_URL: `http://127.0.0.1:${srv.port}`, SUPABASE_SERVICE_ROLE_KEY: "srk" } as Record<string, string>)[k];     const sig = new AbortController().signal;

({ SUPABASE_URL: `http://127.0.0.1:${srv.port}`, SUPABASE_SERVICE_ROLE_KEY: "srk" } as Record<string, string>)[k];

},   "kit": {     "consent": { "label": "POPIA Kit consent banner and ConsentGate", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/registry/README.md" },

"kit": {     "consent": { "label": "POPIA Kit consent banner and ConsentGate", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/registry/README.md" },     "pack": { "label": "Draft it with the compliance pack: uvx popia-ki

"consent": { "label": "POPIA Kit consent banner and ConsentGate", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/registry/README.md" },

"pack": { "label": "Draft it with the compliance pack: uvx popia-kit pack --interactive", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/quickstart.md" },

"security": { "label": "POPIA Kit security controls guide", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/references/03-security-controls.md" },

"operators": { "label": "POPIA Kit guide to operators and cross-border transfers", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/references/06-cross-border-and-operators.md" },

"marketing": { "label": "POPIA Kit marketing opt-in component", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/registry/README.md" },

"scanner": { "label": "Scan your code: uvx popia-kit scan .", "url": "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/quickstart.md" }

Executable file

export const BOT_INFO_URL = "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/site-check-bot.md";

const DOH_URL = "https://cloudflare-dns.com/dns-query";

const TURNSTILE_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";

const target = await assertSafeTarget(current, ctx);     const sig = withTimeout(ctx.signal); // one budget per hop, covering headers and body     const res = await ctx.fetch(target.href, {

const sig = withTimeout(ctx.signal); // one budget per hop, covering headers and body     const res = await ctx.fetch(target.href, {       method: "GET",

const res = await ctx.fetch(target.href, {

[Credential-related source omitted]

? guardedFetch(`http://${final.hostname}/`, ctx, { follow: false, bodyLimit: () => 0 }) // popia-ignore: SEC-009

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Deno.serve(     { onError: () => errorResponse("internal_error", 500, null) },     createHandler({ fetch: (i, init) => fetch(i, init), env: (k) => Deno.env.get(k), rateLimit: supabaseRateLimit }),

{ onError: () => errorResponse("internal_error", 500, null) },     createHandler({ fetch: (i, init) => fetch(i, init), env: (k) => Deno.env.get(k), rateLimit: supabaseRateLimit }),   );

createHandler({ fetch: (i, init) => fetch(i, init), env: (k) => Deno.env.get(k), rateLimit: supabaseRateLimit }),

Executable file

assert(!/[\u2013\u2014!]/.test(text), "dash or exclamation mark");   assert(!/\b(compliant|certified|approved)\b/i.test(text.replace("not a compliance certificate", "")), "claim");   for (const k of Object.values<{ url: string }>(data.kit))

assert(!/\b(compliant|certified|approved)\b/i.test(text.replace("not a compliance certificate", "")), "claim");   for (const k of Object.values<{ url: string }>(data.kit)) assert(k.url.startsWith("https://github.com/VenusOne-Lee/"), k.url);

for (const k of Object.values<{ url: string }>(data.kit)) assert(k.url.startsWith("https://github.com/VenusOne-Lee/"), k.url);

Executable file

const PAGE = `<!doctype html><html><head> <script async src="https://www.googletagmanager.com/gtag/js?id=G-TEST"></script>

<script async src="https://www.googletagmanager.com/gtag/js?id=G-TEST"></script>

Deno.test("parity test_site_check: findings on an insecure tracker page", async () => {   const m = mockFetch({ "http://shop.example.co.za/": () => new Response(PAGE, { headers: pageHeaders() }) });

const m = mockFetch({ "http://shop.example.co.za/": () => new Response(PAGE, { headers: pageHeaders() }) });

const res = await runSiteCheck("http://shop.example.co.za/", makeCtx(m.fn, fakeDns(publicDns("shop.example.co.za")).resolve));

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

assert(ids(res.findings).includes("WEB-012"), "mixed content still reported");   assert(ids(res.findings).includes("WEB-021"), "PI in URL still reported");   assertEquals(res.url, "http://site.example.co.za/profile [query removed]");

assert(ids(res.findings).includes("WEB-021"), "PI in URL still reported");   assertEquals(res.url, "http://site.example.co.za/profile [query removed]"); });

assertEquals(res.url, "http://site.example.co.za/profile [query removed]");

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Deno.test("headers: a well configured HTTPS site has no header findings", () => {   assertEquals(checkHeaders({ finalUrl: "https://example.co.za/", headers: hdr(GOOD) }), []);

assertEquals(checkHeaders({ finalUrl: "https://example.co.za/", headers: hdr(GOOD) }), []);

}); Deno.test("headers: missing headers on HTTPS", () => {   const got = checkHeaders({ finalUrl: "https://example.co.za/", headers: hdr({}) });

Deno.test("headers: missing headers on HTTPS", () => {   const got = checkHeaders({ finalUrl: "https://example.co.za/", headers: hdr({}) });   assertEquals(ids(got), ["WEB-003", "WEB-004", "WEB-005", "WEB-006", "WEB-007", "WEB-008"]);

const got = checkHeaders({ finalUrl: "https://example.co.za/", headers: hdr({}) });

}); Deno.test("headers: HTTP final URL gives WEB-001 and skips HSTS", () => {   const got = checkHeaders({ finalUrl: "http://example.co.za/", headers: hdr(GOOD) });

Deno.test("headers: HTTP final URL gives WEB-001 and skips HSTS", () => {   const got = checkHeaders({ finalUrl: "http://example.co.za/", headers: hdr(GOOD) });   assertEquals(ids(got), ["WEB-001"]);

const got = checkHeaders({ finalUrl: "http://example.co.za/", headers: hdr(GOOD) });

assertEquals(ids(got), ["WEB-001"]);   assertEquals(got[0]!.title, "Site not served over HTTPS");   assertEquals(got[0]!.evidence, "Final URL http://example.co.za/");

assertEquals(got[0]!.title, "Site not served over HTTPS");   assertEquals(got[0]!.evidence, "Final URL http://example.co.za/"); });

assertEquals(got[0]!.evidence, "Final URL http://example.co.za/");

Deno.test("headers: short HSTS, weak CSP, framing and versions", () => {   const short = checkHeaders({     finalUrl: "https://e.co.za/",

const short = checkHeaders({     finalUrl: "https://e.co.za/",     headers: hdr({ ...GOOD, "strict-transport-security": "max-age=300" }),

finalUrl: "https://e.co.za/",

assertEquals(short.map((f) => [f.rule_id, f.title, f.severity]), [["WEB-003", "HSTS max-age is short", "low"]]);   const upper = checkHeaders({     finalUrl: "https://e.co.za/",

const upper = checkHeaders({     finalUrl: "https://e.co.za/",     headers: hdr({ ...GOOD, "strict-transport-security": "Max-Age=300" }),

finalUrl: "https://e.co.za/",

assertEquals(ids(upper), ["WEB-003"]);   const weak = checkHeaders({     finalUrl: "https://e.co.za/",

const weak = checkHeaders({     finalUrl: "https://e.co.za/",     headers: hdr({ ...GOOD, "content-security-policy": "script-src 'self' 'unsafe-inline'; frame-ancestors 'self'" }),

finalUrl: "https://e.co.za/",

assertEquals(weak.map((f) => [f.rule_id, f.title, f.severity]), [["WEB-004", "CSP allows unsafe-inline scripts", "low"]]);   const nonce = checkHeaders({     finalUrl: "https://e.co.za/",

const nonce = checkHeaders({     finalUrl: "https://e.co.za/",     headers: hdr({ ...GOOD, "content-security-policy": "script-src 'nonce-abc' 'unsafe-inline'; frame-ancestors 'self'" }),

finalUrl: "https://e.co.za/",

assertEquals(nonce, []);   const xfo = checkHeaders({     finalUrl: "https://e.co.za/",

const xfo = checkHeaders({     finalUrl: "https://e.co.za/",     headers: hdr({ ...GOOD, "content-security-policy": "default-src 'self'", "x-frame-options": "DENY" }),

finalUrl: "https://e.co.za/",

assertEquals(xfo, []);   const ver = checkHeaders({     finalUrl: "https://e.co.za/",

const ver = checkHeaders({     finalUrl: "https://e.co.za/",     headers: hdr({ ...GOOD, server: "nginx/1.25.3", "x-powered-by": "PHP/8.2.1" }),

finalUrl: "https://e.co.za/",

});   assertEquals(ver.map((f) => f.title), ["Version disclosed in server header", "Version disclosed in x-powered-by header"]);   const nosniff = checkHeaders({ finalUrl: "https://e.co.za/", headers: hdr({ ...GOOD, "x-content-type-options"

assertEquals(ver.map((f) => f.title), ["Version disclosed in server header", "Version disclosed in x-powered-by header"]);   const nosniff = checkHeaders({ finalUrl: "https://e.co.za/", headers: hdr({ ...GOOD, "x-content-type-options": "NOS

const nosniff = checkHeaders({ finalUrl: "https://e.co.za/", headers: hdr({ ...GOOD, "x-content-type-options": "NOSNIFF" }) });

const BASE = "https://example.co.za/";

Deno.test("html: trackers from script hosts and inline code", () => {   const r = checkHtml(     `<script src="https://connect.facebook.net/en_US/fbevents.js"></script>

const r = checkHtml(     `<script src="https://connect.facebook.net/en_US/fbevents.js"></script>      <script src="//static.hotjar.com/c/hotjar.js"></script>

`<script src="https://connect.facebook.net/en_US/fbevents.js"></script>

Deno.test("html: a consent tool or Consent Mode default suppresses WEB-013 only", () => {   const tool = checkHtml(     `<script src="https://consent.cookiebot.com/uc.js"></script>

const tool = checkHtml(     `<script src="https://consent.cookiebot.com/uc.js"></script>     <script src="https://www.googletagmanager.com/gtag/js?id=G-1"></script><a href="/cookie-policy">Cookies</a>`,

`<script src="https://consent.cookiebot.com/uc.js"></script>

<script src="https://www.googletagmanager.com/gtag/js?id=G-1"></script><a href="/cookie-policy">Cookies</a>`,

}); Deno.test("html: commented-out trackers are ignored", () => {   const r = checkHtml(`<!-- <script src="https://connect.facebook.net/x.js"></script> fbq('init','1') -->`, BASE);

Deno.test("html: commented-out trackers are ignored", () => {   const r = checkHtml(`<!-- <script src="https://connect.facebook.net/x.js"></script> fbq('init','1') -->`, BASE);   assertEquals(r.trackers, []);

const r = checkHtml(`<!-- <script src="https://connect.facebook.net/x.js"></script> fbq('init','1') -->`, BASE);

Deno.test("html: password field on HTTP only", () => {   const form = `<form><input type="password" name="pw"></form>`;   assert(ids(checkHtml(form, "http://example.co.za/").findings).includes("WEB-020"));

const form = `<form><input type="password" name="pw"></form>`;   assert(ids(checkHtml(form, "http://example.co.za/").findings).includes("WEB-020"));   assert(!ids(checkHtml(form, BASE).findings).includes("WEB-020"));

assert(ids(checkHtml(form, "http://example.co.za/").findings).includes("WEB-020"));

Deno.test("html: mixed content and PI in URLs", () => {   const r = checkHtml(     `<script src="http://cdn.example.co.za/a.js"></script><script src="https://ok.example.co.za/b.js?mobile=0821234567"></script>

const r = checkHtml(     `<script src="http://cdn.example.co.za/a.js"></script><script src="https://ok.example.co.za/b.js?mobile=0821234567"></script>     <a href="/x?phone=1">a</a><a href="/y?email=a@b.co">b</a>`,

`<script src="http://cdn.example.co.za/a.js"></script><script src="https://ok.example.co.za/b.js?mobile=0821234567"></script>

Deno.test("safeUrl: credentials, query and fragment never appear", () => {   const cases: Array<[string, string]> = [     ["https://user:pass@example.co.za/a?b=c#d", "https://example.co.za/a [query removed]"],

const cases: Array<[string, string]> = [     ["https://user:pass@example.co.za/a?b=c#d", "https://example.co.za/a [query removed]"],     ["https://example.co.za/a#d", "https://example.co.za/a"],

["https://user:pass@example.co.za/a?b=c#d", "https://example.co.za/a [query removed]"],

["https://example.co.za/a#d", "https://example.co.za/a"],

["https://example.co.za/a?", "https://example.co.za/a"],

["http://example.co.za:8080/x", "http://example.co.za:8080/x"],

["//cdn.example.co.za/a.js?t=1", "//cdn.example.co.za/a.js [query removed]"],     ["//u:p@cdn.example.co.za/a.js", "//cdn.example.co.za/a.js"],     ["https://e.co.za/u/person@example.test/x", "https://e.co.za/u/pe***@example.test/x"],

["//u:p@cdn.example.co.za/a.js", "//cdn.example.co.za/a.js"],     ["https://e.co.za/u/person@example.test/x", "https://e.co.za/u/pe***@example.test/x"],     ["https://e.co.za/u/person%40example.test", "https://e.co.za/u/pe***%40example.test

["https://e.co.za/u/person@example.test/x", "https://e.co.za/u/pe***@example.test/x"],

["https://e.co.za/u/person%40example.test", "https://e.co.za/u/pe***%40example.test"],

["https://e.co.za/id/1234567890123", "https://e.co.za/id/*************"],

["https://e.co.za/acct/123456789012", "https://e.co.za/acct/*********"],

["https://e.co.za/t/eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig", "https://e.co.za/t/eyJhbGc…REDACTED"],

["https://e.co.za/k/" + "a".repeat(40), "https://e.co.za/k/…REDACTED"],

];   for (const [inp, out] of cases) assertEquals(safeUrl(inp), out, inp);   assertEquals(safeUrl("https://e.co.za/a/b", false), "https://e.co.za");

for (const [inp, out] of cases) assertEquals(safeUrl(inp), out, inp);   assertEquals(safeUrl("https://e.co.za/a/b", false), "https://e.co.za"); });

assertEquals(safeUrl("https://e.co.za/a/b", false), "https://e.co.za");

Deno.test("parity test_site_check: the user agent names the checker and links its page", () => {   assertEquals(BOT_INFO_URL, "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/site-check-bot.md");

assertEquals(BOT_INFO_URL, "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/site-check-bot.md");

Executable file

"javascript:alert(1)",     "ws://example.co.za/",     "http://example.co.za:8080/",

"ws://example.co.za/",     "http://example.co.za:8080/",     "https://example.co.za:22/",

"http://example.co.za:8080/",

"https://example.co.za:22/",

"http://example.co.za:0/",

"https://example.co.za:8443/",

"http://localhost/",

"http://LOCALHOST./",

"http://foo.localhost/",

"http://printer.local/",

"http://metadata.google.internal/computeMetadata/v1/",

"http://router.lan/",

"http://nas.home.arpa/",

"http://intranet/",

"http://127.0.0.1/",

"http://127.1/",

"http://2130706433/",

"http://0x7f.1/",

"http://0177.0.0.1/",

"http://0x7f000001/",

"http://10.0.0.1/",

"http://192.168.1.1/",

"http://169.254.169.254/latest/meta-data/",

"http://[::1]/",

"http://[::ffff:127.0.0.1]/",

"http://[::ffff:a9fe:a9fe]/",

"http://[fd00::1]/",

"http://[fe80::1]/",

"http://0.0.0.0/",

"http://0/",

"http://100.64.1.1/",

"http://user:pass@127.0.0.1/",

"http://example.co.za@127.0.0.1/",

Deno.test("url guard: allows public targets and strips credentials and fragment", () => {   const ok: Array<[string, string]> = [     ["https://example.co.za/", "https://example.co.za/"],

const ok: Array<[string, string]> = [     ["https://example.co.za/", "https://example.co.za/"],     ["http://example.co.za:80/", "http://example.co.za/"],

["https://example.co.za/", "https://example.co.za/"],

["http://example.co.za:80/", "http://example.co.za/"],

["http://example.co.za:443/", "http://example.co.za:443/"],

["https://example.co.za:443/a", "https://example.co.za/a"],

["https://user:pass@example.co.za/x?q=1#frag", "https://example.co.za/x?q=1"],

["https://EXAMPLE.co.za/", "https://example.co.za/"],

["https://8.8.8.8/", "https://8.8.8.8/"],

["https://[2606:4700:4700::1111]/", "https://[2606:4700:4700::1111]/"],

["https://bücher.de/", "https://xn--bcher-kva.de/"],

}); Deno.test("url guard: zone IDs and garbage are invalid", () => {   assertThrowsType(() => validateTargetUrl("http://[fe80::1%25eth0]/"), "invalid_url");

Deno.test("url guard: zone IDs and garbage are invalid", () => {   assertThrowsType(() => validateTargetUrl("http://[fe80::1%25eth0]/"), "invalid_url");   assertThrowsType(() => validateTargetUrl("https://exa mple.co.za/"), "invalid_url");

assertThrowsType(() => validateTargetUrl("http://[fe80::1%25eth0]/"), "invalid_url");

assertThrowsType(() => validateTargetUrl("https://exa mple.co.za/"), "invalid_url");

}); Deno.test("input normalisation: adds https and refuses other schemes", () => {   assertEquals(normaliseInputUrl("example.co.za"), "https://example.co.za");

Deno.test("input normalisation: adds https and refuses other schemes", () => {   assertEquals(normaliseInputUrl("example.co.za"), "https://example.co.za");   assertEquals(normaliseInputUrl("  HTTP://Example.co.za/x "), "HTTP://Example.co.za

assertEquals(normaliseInputUrl("example.co.za"), "https://example.co.za");

assertEquals(normaliseInputUrl("  HTTP://Example.co.za/x "), "HTTP://Example.co.za/x");

}); Deno.test("dns: DoH resolver sends the right request and parses JSON", async () => {   const doh = "https://cloudflare-dns.com/dns-query?name=example.co.za&type=A";

Deno.test("dns: DoH resolver sends the right request and parses JSON", async () => {   const doh = "https://cloudflare-dns.com/dns-query?name=example.co.za&type=A";   const m = mockFetch({

const doh = "https://cloudflare-dns.com/dns-query?name=example.co.za&type=A";

Deno.test("dns: DoH errors fail closed", async () => {   const name = "a&type=TXT&x=.example.co.za";   const enc = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=A`;

const name = "a&type=TXT&x=.example.co.za";   const enc = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=A`;   const m1 = mockFetch({ [enc]: () => new Response("x", { status: 500 }) });

const enc = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=A`;

}); Deno.test("dns: a full check goes through DoH and refuses a private answer", async () => {   const doh = (n: string, t: string) => `https://cloudflare-dns.com/dns-query?name=${n}&type=${t}`;

Deno.test("dns: a full check goes through DoH and refuses a private answer", async () => {   const doh = (n: string, t: string) => `https://cloudflare-dns.com/dns-query?name=${n}&type=${t}`;   const m = mockFetch({

const doh = (n: string, t: string) => `https://cloudflare-dns.com/dns-query?name=${n}&type=${t}`;

});   const ctx = makeCtx(m.fn, dohResolver(m.fn));   await assertRejectsType(() => runSiteCheck("https://evil.example.co.za/", ctx), "blocked_target");

const ctx = makeCtx(m.fn, dohResolver(m.fn));   await assertRejectsType(() => runSiteCheck("https://evil.example.co.za/", ctx), "blocked_target");   assert(m.calls.every((c) => c.url.startsWith("https://cloudflare-dns.com/")), "target never

await assertRejectsType(() => runSiteCheck("https://evil.example.co.za/", ctx), "blocked_target");

assert(m.calls.every((c) => c.url.startsWith("https://cloudflare-dns.com/")), "target never fetched");

Deno.test("redirects: a hop to a private IP literal is refused before it is fetched", async () => {   const m = mockFetch({ "https://example.co.za/": redirect("http://127.0.0.1:80/admin") });

const m = mockFetch({ "https://example.co.za/": redirect("http://127.0.0.1:80/admin") });

const ctx = makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve);   await assertRejectsType(() => guardedFetch("https://example.co.za/", ctx, noBody), "blocked_target");   assertEquals(m.calls.map((c) => c.url), ["https://example.co.z

await assertRejectsType(() => guardedFetch("https://example.co.za/", ctx, noBody), "blocked_target");

assertEquals(m.calls.map((c) => c.url), ["https://example.co.za/"]);

}); Deno.test("redirects: a hop to a name that resolves privately is refused before it is fetched", async () => {   const m = mockFetch({ "https://example.co.za/": redirect("https://internal.example.co.za/") });

Deno.test("redirects: a hop to a name that resolves privately is refused before it is fetched", async () => {   const m = mockFetch({ "https://example.co.za/": redirect("https://internal.example.co.za/") });   const dns = fakeDns({ ...publi

const m = mockFetch({ "https://example.co.za/": redirect("https://internal.example.co.za/") });

const dns = fakeDns({ ...publicDns("example.co.za"), "internal.example.co.za": { A: ["10.1.2.3"] } });   await assertRejectsType(() => guardedFetch("https://example.co.za/", makeCtx(m.fn, dns.resolve), noBody), "blocked_target");   assertEq

await assertRejectsType(() => guardedFetch("https://example.co.za/", makeCtx(m.fn, dns.resolve), noBody), "blocked_target");

"ftp://example.co.za/",       "file:///etc/passwd",       "https://example.co.za:8443/",

"file:///etc/passwd",       "https://example.co.za:8443/",       "http://169.254.169.254/",

"https://example.co.za:8443/",

"http://169.254.169.254/",

"http://[::ffff:169.254.169.254]/",

"http://metadata.google.internal/",

"http://localhost/",

]   ) {     const m = mockFetch({ "https://example.co.za/": redirect(loc) });

) {     const m = mockFetch({ "https://example.co.za/": redirect(loc) });     const ctx = makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve);

const m = mockFetch({ "https://example.co.za/": redirect(loc) });

const ctx = makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve);     await assertRejectsType(() => guardedFetch("https://example.co.za/", ctx, noBody), "blocked_target", loc);     assertEquals(m.calls.length, 1, loc);

await assertRejectsType(() => guardedFetch("https://example.co.za/", ctx, noBody), "blocked_target", loc);

Deno.test("redirects: five hops are followed, the sixth is refused", async () => {   const routes: Record<string, () => Response> = {};   for (let i = 0; i < 5; i++) routes[`https://example.co.za/${i}`] = redirect(`/${i + 1}`);

const routes: Record<string, () => Response> = {};   for (let i = 0; i < 5; i++) routes[`https://example.co.za/${i}`] = redirect(`/${i + 1}`);   routes["https://example.co.za/5"] = html("<p>done</p>");

for (let i = 0; i < 5; i++) routes[`https://example.co.za/${i}`] = redirect(`/${i + 1}`);

routes["https://example.co.za/5"] = html("<p>done</p>");

const m = mockFetch(routes);   const r = await guardedFetch("https://example.co.za/0", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve), noBody);   assertEquals(r.url, "https://example.co.za/5");

const r = await guardedFetch("https://example.co.za/0", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve), noBody);

assertEquals(r.url, "https://example.co.za/5");

routes["https://example.co.za/5"] = redirect("/6");

routes["https://example.co.za/6"] = html("<p>too far</p>");

const m2 = mockFetch(routes);   await assertRejectsType(     () => guardedFetch("https://example.co.za/0", makeCtx(m2.fn, fakeDns(publicDns("example.co.za")).resolve), noBody),

await assertRejectsType(     () => guardedFetch("https://example.co.za/0", makeCtx(m2.fn, fakeDns(publicDns("example.co.za")).resolve), noBody),     "too_many_redirects",

() => guardedFetch("https://example.co.za/0", makeCtx(m2.fn, fakeDns(publicDns("example.co.za")).resolve), noBody),

Deno.test("redirects: every request is GET with manual redirects, a signal and no credentials", async () => {   const m = mockFetch({     "https://example.co.za/": redirect("https://admin:hunter2@www.example.co.za/next#x", 301),

const m = mockFetch({     "https://example.co.za/": redirect("https://admin:hunter2@www.example.co.za/next#x", 301),     "https://www.example.co.za/next": html("<p>ok</p>"),

"https://example.co.za/": redirect("https://admin:hunter2@www.example.co.za/next#x", 301),

"https://www.example.co.za/next": html("<p>ok</p>"),

});   const ctx = makeCtx(m.fn, fakeDns(publicDns("example.co.za", "www.example.co.za")).resolve);   const r = await guardedFetch("https://u:p@example.co.za/", ctx, noBody);

const ctx = makeCtx(m.fn, fakeDns(publicDns("example.co.za", "www.example.co.za")).resolve);   const r = await guardedFetch("https://u:p@example.co.za/", ctx, noBody);   assertEquals(r.url, "https://www.example.co.za/next");

const r = await guardedFetch("https://u:p@example.co.za/", ctx, noBody);

assertEquals(r.url, "https://www.example.co.za/next");

Deno.test("probes: http and security.txt probes go through the same guard", async () => {   const m = mockFetch({     "https://example.co.za/": html("<a href='/privacy'>Privacy</a><a href='/paia'>PAIA</a>"),

const m = mockFetch({     "https://example.co.za/": html("<a href='/privacy'>Privacy</a><a href='/paia'>PAIA</a>"),     "http://example.co.za/": redirect("http://10.0.0.1/"),

"https://example.co.za/": html("<a href='/privacy'>Privacy</a><a href='/paia'>PAIA</a>"),

"http://example.co.za/": redirect("http://10.0.0.1/"),

"https://example.co.za/.well-known/security.txt": redirect("http://169.254.169.254/latest/meta-data/"),

});   const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve));   assert(!m.calls.some((c) => c.url.includes("10.0.0.1") || c.url.includes("169.254")), "private hops never fetched"

const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve));

assert(ids.includes("WEB-002"), "http probe that does not redirect to https is flagged");   assert(ids.includes("WEB-018"), "security.txt probe failure reads as missing");   assertEquals(m.calls.find((c) => c.url === "http://example.co.za/"

assert(ids.includes("WEB-018"), "security.txt probe failure reads as missing");   assertEquals(m.calls.find((c) => c.url === "http://example.co.za/") !== undefined, true); });

assertEquals(m.calls.find((c) => c.url === "http://example.co.za/") !== undefined, true);

const counter = { pulled: 0, cancelled: false };   const m = mockFetch({     "https://example.co.za/": () =>

const m = mockFetch({     "https://example.co.za/": () =>       new Response(endless(65_536, counter, "<a href='/privacy'>Privacy</a>"), { headers: { "content-type": "text/html" } }),

"https://example.co.za/": () =>

new Response(endless(65_536, counter, "<a href='/privacy'>Privacy</a>"), { headers: { "content-type": "text/html" } }),   });   const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resol

});   const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve));   assert(counter.pulled <= LIMITS.maxBodyBytes + 65_536, `pulled ${counter.pulled}`);

const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve));

const counter = { pulled: 0, cancelled: false };   const m = mockFetch({     "https://example.co.za/": () =>

const m = mockFetch({     "https://example.co.za/": () =>       new Response(endless(65_536, counter, "<a href='/privacy'>Privacy</a>"), {

"https://example.co.za/": () =>

}),   });   const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve));

});   const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve));   assert(counter.pulled <= 65_536, `pulled ${counter.pulled}`);

const res = await runSiteCheck("https://example.co.za/", makeCtx(m.fn, fakeDns(publicDns("example.co.za")).resolve));

let name = "";       try {         await guardedFetch("https://example.co.za/", ctx, noBody);

try {         await guardedFetch("https://example.co.za/", ctx, noBody);       } catch (e) {

await guardedFetch("https://example.co.za/", ctx, noBody);

let name = "";     try {       await guardedFetch("https://example.co.za/", ctx, noBody);

try {       await guardedFetch("https://example.co.za/", ctx, noBody);     } catch (e) {

await guardedFetch("https://example.co.za/", ctx, noBody);

Executable file

const ORIGIN = "https://check.venusone.co.za";

[Credential-related source omitted]

const SITE: Record<string, Route> = {   "https://example.co.za/": html(`<a href="/privacy">Privacy</a><a href="/paia">PAIA</a>`, {     "strict-transport-security": "max-age=63072000",

"https://example.co.za/": html(`<a href="/privacy">Privacy</a><a href="/paia">PAIA</a>`, {

"strict-transport-security": "max-age=63072000",   }),   "http://example.co.za/": () => new Response(null, { status: 301, headers: { location: "https://example.co.za/" } }),

}),   "http://example.co.za/": () => new Response(null, { status: 301, headers: { location: "https://example.co.za/" } }),   "https://example.co.za/.well-known/security.txt": () =>

"http://example.co.za/": () => new Response(null, { status: 301, headers: { location: "https://example.co.za/" } }),

"https://example.co.za/.well-known/security.txt": () =>

function setup(o: Setup = {}) {   const env: Record<string, string> = {     ALLOWED_ORIGINS: `${ORIGIN}, https://www.venusone.co.za`,

const env: Record<string, string> = {     ALLOWED_ORIGINS: `${ORIGIN}, https://www.venusone.co.za`,     RATE_LIMIT_SALT: "test-salt",

ALLOWED_ORIGINS: `${ORIGIN}, https://www.venusone.co.za`,

});   const fetchFn: Deps["fetch"] = (u, init) => {     log.push(u.startsWith("https://challenges.cloudflare.com/") ? "turnstile" : "fetch");

const fetchFn: Deps["fetch"] = (u, init) => {     log.push(u.startsWith("https://challenges.cloudflare.com/") ? "turnstile" : "fetch");     return m.fn(u, init);

log.push(u.startsWith("https://challenges.cloudflare.com/") ? "turnstile" : "fetch");

function post(body: unknown, headers: Record<string, string> = {}) {   return new Request("https://proj.supabase.co/functions/v1/site-check", {

return new Request("https://proj.supabase.co/functions/v1/site-check", {

Deno.test("cors: missing, unknown and lookalike origins are refused with 403", async () => {   for (const origin of [null, "https://evil.example", "https://check.venusone.co.za.evil.example", "null", ORIGIN + "/"]) {

for (const origin of [null, "https://evil.example", "https://check.venusone.co.za.evil.example", "null", ORIGIN + "/"]) {

const headers: Record<string, string> = { "content-type": "application/json" };     if (origin) headers["origin"] = origin;     const { res, body } = await call(s, new Request("https://x.supabase.co/f", { method: "POST", headers, body: "{}"

if (origin) headers["origin"] = origin;     const { res, body } = await call(s, new Request("https://x.supabase.co/f", { method: "POST", headers, body: "{}" }));     assertEquals(res.status, 403, String(origin));

const { res, body } = await call(s, new Request("https://x.supabase.co/f", { method: "POST", headers, body: "{}" }));

Deno.test("cors: empty ALLOWED_ORIGINS refuses everything", async () => {   const s = setup({ env: { ALLOWED_ORIGINS: "" } });   const { res } = await call(s, post({ url: "https://example.co.za/" }));

const s = setup({ env: { ALLOWED_ORIGINS: "" } });   const { res } = await call(s, post({ url: "https://example.co.za/" }));   assertEquals(res.status, 403);

const { res } = await call(s, post({ url: "https://example.co.za/" }));

const s = setup();   const ok = await s.handler(     new Request("https://x/f", { method: "OPTIONS", headers: { origin: "https://www.venusone.co.za" } }),

const ok = await s.handler(     new Request("https://x/f", { method: "OPTIONS", headers: { origin: "https://www.venusone.co.za" } }),   );

new Request("https://x/f", { method: "OPTIONS", headers: { origin: "https://www.venusone.co.za" } }),

);   assertEquals(ok.status, 204);   assertEquals(ok.headers.get("access-control-allow-origin"), "https://www.venusone.co.za");

assertEquals(ok.status, 204);   assertEquals(ok.headers.get("access-control-allow-origin"), "https://www.venusone.co.za");   assertEquals(ok.headers.get("access-control-allow-methods"), "POST, OPTIONS");

assertEquals(ok.headers.get("access-control-allow-origin"), "https://www.venusone.co.za");

assert(ok.headers.get("access-control-allow-headers")!.includes("content-type"));   assertEquals(ok.headers.get("vary"), "Origin");   const bad = await s.handler(new Request("https://x/f", { method: "OPTIONS", headers: { origin: "https://ev

assertEquals(ok.headers.get("vary"), "Origin");   const bad = await s.handler(new Request("https://x/f", { method: "OPTIONS", headers: { origin: "https://evil.example" } }));   assertEquals(bad.status, 403);

const bad = await s.handler(new Request("https://x/f", { method: "OPTIONS", headers: { origin: "https://evil.example" } }));

for (const method of ["GET", "PUT", "DELETE"]) {     const s = setup();     const { res, body } = await call(s, new Request("https://x/f", { method, headers: { origin: ORIGIN } }));

const s = setup();     const { res, body } = await call(s, new Request("https://x/f", { method, headers: { origin: ORIGIN } }));     assertEquals(res.status, 405);

const { res, body } = await call(s, new Request("https://x/f", { method, headers: { origin: ORIGIN } }));

Deno.test("body: JSON only, small, with a url", async () => {   const s = setup();   const r1 = await call(s, post({ url: "https://example.co.za/" }, { "content-type": "text/plain" }));

const s = setup();   const r1 = await call(s, post({ url: "https://example.co.za/" }, { "content-type": "text/plain" }));   assertEquals(r1.res.status, 400);

const r1 = await call(s, post({ url: "https://example.co.za/" }, { "content-type": "text/plain" }));

const r2 = await call(s, post("{not json"));   isError(r2.body, "invalid_request");   const r3 = await call(s, post({ url: "https://example.co.za/" + "a".repeat(9_000) }));

isError(r2.body, "invalid_request");   const r3 = await call(s, post({ url: "https://example.co.za/" + "a".repeat(9_000) }));   isError(r3.body, "invalid_request");

const r3 = await call(s, post({ url: "https://example.co.za/" + "a".repeat(9_000) }));

const r4 = await call(s, post({ url: 42 }));   isError(r4.body, "invalid_url");   const r5 = await call(s, post({ url: "https://example.co.za/" + "a".repeat(3_000) }));

isError(r4.body, "invalid_url");   const r5 = await call(s, post({ url: "https://example.co.za/" + "a".repeat(3_000) }));   isError(r5.body, "invalid_url");

const r5 = await call(s, post({ url: "https://example.co.za/" + "a".repeat(3_000) }));

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

const { res, body } = await call(s, post({ url: "https://example.co.za/" }));

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

routes: { "https://challenges.cloudflare.com/turnstile/v0/siteverify": turnstile(false, seen) },

});   const r1 = await call(bad, post({ url: "https://example.co.za/", turnstileToken: "tok" }));   assertEquals(r1.res.status, 403);

const r1 = await call(bad, post({ url: "https://example.co.za/", turnstileToken: "tok" }));

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

routes: { "https://challenges.cloudflare.com/turnstile/v0/siteverify": turnstile(true, []) },

});   const r2 = await call(good, post({ url: "https://example.co.za/", turnstileToken: "tok" }));   assertEquals(r2.res.status, 200);

const r2 = await call(good, post({ url: "https://example.co.za/", turnstileToken: "tok" }));   assertEquals(r2.res.status, 200);   assertEquals(good.log.slice(0, 4), ["turnstile", "ratelimit", "ratelimit", "fetch"], "per-IP then global, the

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

routes: { "https://challenges.cloudflare.com/turnstile/v0/siteverify": () => new Response("oops", { status: 500 }) },

});   const { res } = await call(s, post({ url: "https://example.co.za/", turnstileToken: "tok" }));   assertEquals(res.status, 403);

const { res } = await call(s, post({ url: "https://example.co.za/", turnstileToken: "tok" }));

Deno.test("turnstile: not required when no secret is set", async () => {   const s = setup();   const { res } = await call(s, post({ url: "https://example.co.za/" }));

const s = setup();   const { res } = await call(s, post({ url: "https://example.co.za/" }));   assertEquals(res.status, 200);

const { res } = await call(s, post({ url: "https://example.co.za/" }));

for (const c of cases) {     const s = setup(c);     const { res, body } = await call(s, post({ url: "https://example.co.za/" }));

const s = setup(c);     const { res, body } = await call(s, post({ url: "https://example.co.za/" }));     assertEquals(res.status, 429);

const { res, body } = await call(s, post({ url: "https://example.co.za/" }));

Deno.test("rate limit: salted hash of the client IP, default and custom limits", async () => {   const s = setup();   await call(s, post({ url: "https://example.co.za/" }));

const s = setup();   await call(s, post({ url: "https://example.co.za/" }));   assertEquals(s.hits[0]!.limit, 10);

await call(s, post({ url: "https://example.co.za/" }));

assert(!s.hits[0]!.hash.includes("41.1.2.3"));   const s2 = setup({ env: { RATE_LIMIT_PER_HOUR: "3" } });   await call(s2, post({ url: "https://example.co.za/" }));

const s2 = setup({ env: { RATE_LIMIT_PER_HOUR: "3" } });   await call(s2, post({ url: "https://example.co.za/" }));   assertEquals(s2.hits[0]!.limit, 3);

await call(s2, post({ url: "https://example.co.za/" }));

assertEquals(s2.hits[0]!.limit, 3);   const s3 = setup({ env: { RATE_LIMIT_PER_HOUR: "-5" } });   await call(s3, post({ url: "https://example.co.za/" }));

const s3 = setup({ env: { RATE_LIMIT_PER_HOUR: "-5" } });   await call(s3, post({ url: "https://example.co.za/" }));   assertEquals(s3.hits[0]!.limit, 10);

await call(s3, post({ url: "https://example.co.za/" }));

Deno.test("rate limit: rate limiting happens before URL validation", async () => {   const s = setup();   await call(s, post({ url: "http://127.0.0.1/" }));

const s = setup();   await call(s, post({ url: "http://127.0.0.1/" }));   assertEquals(s.hits.length, 2, "per-IP and global checks both run before URL validation");

await call(s, post({ url: "http://127.0.0.1/" }));

try {       const env = (k: string) =>         ({ SUPABASE_URL: "https://proj.supabase.co", SUPABASE_SERVICE_ROLE_KEY: "srk" } as Record<string, string>)[k];

const env = (k: string) =>         ({ SUPABASE_URL: "https://proj.supabase.co", SUPABASE_SERVICE_ROLE_KEY: "srk" } as Record<string, string>)[k];       const sig = new AbortController().signal;

({ SUPABASE_URL: "https://proj.supabase.co", SUPABASE_SERVICE_ROLE_KEY: "srk" } as Record<string, string>)[k];

const sig = new AbortController().signal;       assertEquals(await supabaseRateLimit("a".repeat(64), 7, sig, env), true);       assertEquals(seen[0]!.url, "https://proj.supabase.co/rest/v1/rpc/site_check_hit");

assertEquals(await supabaseRateLimit("a".repeat(64), 7, sig, env), true);       assertEquals(seen[0]!.url, "https://proj.supabase.co/rest/v1/rpc/site_check_hit");       assertEquals(JSON.parse(seen[0]!.body), { p_ip_hash: "a".repeat(64), p_

assertEquals(seen[0]!.url, "https://proj.supabase.co/rest/v1/rpc/site_check_hit");

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

`http://169.254.169.254/latest/meta-data/?k=${SECRET}`,

`http://localhost/${SECRET}`,

`ftp://example.co.za/${SECRET}`,       `http://example.co.za:8080/${SECRET}`,     ]

`http://example.co.za:8080/${SECRET}`,

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Deno.test("errors: DNS failure and redirect loops", async () => {   const s = setup();   const r1 = await call(s, post({ url: "https://unknown.example.co.za/" }));

const s = setup();   const r1 = await call(s, post({ url: "https://unknown.example.co.za/" }));   assertEquals(r1.res.status, 502);

const r1 = await call(s, post({ url: "https://unknown.example.co.za/" }));

isError(r1.body, "dns_failed");   const s2 = setup({     routes: { "https://example.co.za/": () => new Response(null, { status: 302, headers: { location: "/" } }) },

const s2 = setup({     routes: { "https://example.co.za/": () => new Response(null, { status: 302, headers: { location: "/" } }) },   });

routes: { "https://example.co.za/": () => new Response(null, { status: 302, headers: { location: "/" } }) },

});   const r2 = await call(s2, post({ url: "https://example.co.za/" }));   isError(r2.body, "too_many_redirects");

const r2 = await call(s2, post({ url: "https://example.co.za/" }));

];   for (const [route, type] of cases) {     const s = setup({ routes: { "https://example.co.za/": route } });

for (const [route, type] of cases) {     const s = setup({ routes: { "https://example.co.za/": route } });     const { res, body } = await call(s, post({ url: "https://example.co.za/" }));

const s = setup({ routes: { "https://example.co.za/": route } });

const { res, body } = await call(s, post({ url: "https://example.co.za/" }));

Deno.test("success: response shape, headers and a clean site", async () => {   const s = setup();   const { res, body } = await call(s, post({ url: "https://user:pw@example.co.za/#x" }));

const s = setup();   const { res, body } = await call(s, post({ url: "https://user:pw@example.co.za/#x" }));   assertEquals(res.status, 200);

const { res, body } = await call(s, post({ url: "https://user:pw@example.co.za/#x" }));

assertEquals(res.headers.get("content-type"), "application/json; charset=utf-8");   assertEquals(Object.keys(body), ["url", "final_url", "checked_at", "summary", "findings", "cookies", "notices", "disclaimer"]);   assertEquals(body["url"], 

assertEquals(Object.keys(body), ["url", "final_url", "checked_at", "summary", "findings", "cookies", "notices", "disclaimer"]);   assertEquals(body["url"], "https://example.co.za/");   assertEquals(body["checked_at"], "2026-10-18T09:00:00+0

assertEquals(body["url"], "https://example.co.za/");

const shell = `<html><body><div id="root"></div></body></html>`;   const routes: Record<string, Route> = {     "https://example.co.za/": html(shell),

const routes: Record<string, Route> = {     "https://example.co.za/": html(shell),     "https://example.co.za/privacy": html(shell), // SPA fallback: same body, not a notice

"https://example.co.za/": html(shell),

"https://example.co.za/privacy": html(shell), // SPA fallback: same body, not a notice

"https://example.co.za/privacy-policy": html("<h1>Privacy notice</h1>"),

"https://example.co.za/paia-manual": () => new Response("%PDF-1.7", { headers: { "content-type": "application/pdf" } }),

};   const off = setup({ routes });   const r1 = await call(off, post({ url: "https://example.co.za/" }));

const off = setup({ routes });   const r1 = await call(off, post({ url: "https://example.co.za/" }));   assertEquals(r1.body["notices"], { privacy: false, paia: false, cookie: false, information_officer: false });

const r1 = await call(off, post({ url: "https://example.co.za/" }));

assert(!off.calls.some((c) => c.url.endsWith("/privacy")));   const on = setup({ routes, env: { PROBE_NOTICE_PATHS: "true" } });   const r2 = await call(on, post({ url: "https://example.co.za/" }));

const on = setup({ routes, env: { PROBE_NOTICE_PATHS: "true" } });   const r2 = await call(on, post({ url: "https://example.co.za/" }));   assertEquals(r2.body["notices"], { privacy: true, paia: true, cookie: false, information_officer: fal

const r2 = await call(on, post({ url: "https://example.co.za/" }));

Deno.test("copy: no dashes, exclamation marks or compliance claims in user-facing strings", async () => {   const strings: string[] = [...Object.values(ERROR_MESSAGES), DISCLAIMER];   const bad = `<script src="http://www.googletagmanager.co

const strings: string[] = [...Object.values(ERROR_MESSAGES), DISCLAIMER];   const bad = `<script src="http://www.googletagmanager.com/gtag/js"></script><script>fbq('init','1')</script>     <form><input type="password"><input type="checkbox"

const bad = `<script src="http://www.googletagmanager.com/gtag/js"></script><script>fbq('init','1')</script>

h.append("set-cookie", "_ga=1");   h.append("set-cookie", "sessionid=1");   const s = setup({ routes: { "http://example.co.za/": () => new Response(bad, { headers: h }) } });

h.append("set-cookie", "sessionid=1");   const s = setup({ routes: { "http://example.co.za/": () => new Response(bad, { headers: h }) } });   const { body } = await call(s, post({ url: "http://example.co.za/" }));

const s = setup({ routes: { "http://example.co.za/": () => new Response(bad, { headers: h }) } });

const { body } = await call(s, post({ url: "http://example.co.za/" }));

Executable file

const ORIGIN = "https://check.venusone.co.za";

const env: Record<string, string> = { ALLOWED_ORIGINS: ORIGIN, RATE_LIMIT_SALT: SALT, ...o.env };   const m = mockFetch({     "https://example.co.za/": html("<p>ok</p>"),

const m = mockFetch({     "https://example.co.za/": html("<p>ok</p>"),   });

"https://example.co.za/": html("<p>ok</p>"),

function post(headers: Record<string, string> = {}, body: BodyInit = JSON.stringify({ url: "https://example.co.za/" })) {

return new Request("https://proj.supabase.co/functions/v1/site-check", {

const noEnv = () => undefined; const reqWith = (h: Record<string, string>) => new Request("https://x/f", { headers: h });

const reqWith = (h: Record<string, string>) => new Request("https://x/f", { headers: h });

h.append("x-forwarded-for", "6.6.6.6");   h.append("x-forwarded-for", "41.0.0.3");   assertEquals(clientIp(new Request("https://x/f", { headers: h }), noEnv), "41.0.0.3", "repeated header lines");

h.append("x-forwarded-for", "41.0.0.3");   assertEquals(clientIp(new Request("https://x/f", { headers: h }), noEnv), "41.0.0.3", "repeated header lines");   assertEquals(clientIp(reqWith({}), noEnv), null);

assertEquals(clientIp(new Request("https://x/f", { headers: h }), noEnv), "41.0.0.3", "repeated header lines");

Deno.test("redos: safeUrl bounds long paths and never leaves part of a token at the cut", () => {   let t = performance.now();   const out = safeUrl("https://e.co.za/" + "a".repeat(1_000_000));

let t = performance.now();   const out = safeUrl("https://e.co.za/" + "a".repeat(1_000_000));   fast(performance.now() - t, 200, "1 MB path");

const out = safeUrl("https://e.co.za/" + "a".repeat(1_000_000));

assertEquals(out, "https://e.co.za/…");

const path = "/" + "p/".repeat(245) + "Q".repeat(40) + "/tail";   t = performance.now();   const cut = safeUrl("https://e.co.za" + path);

t = performance.now();   const cut = safeUrl("https://e.co.za" + path);   fast(performance.now() - t, 50, "cut path");

const cut = safeUrl("https://e.co.za" + path);

assert(!cut.includes("QQQQ"), cut.slice(-40));   assert(cut.endsWith("/…"), cut.slice(-10));   assert(cut.length <= "https://e.co.za".length + LIMITS.maxReportPath + 1);

assert(cut.endsWith("/…"), cut.slice(-10));   assert(cut.length <= "https://e.co.za".length + LIMITS.maxReportPath + 1);   const mail = safeUrl("https://e.co.za/" + "x/".repeat(250) + "person@example.test/" + "y".repeat(600));

assert(cut.length <= "https://e.co.za".length + LIMITS.maxReportPath + 1);

const mail = safeUrl("https://e.co.za/" + "x/".repeat(250) + "person@example.test/" + "y".repeat(600));

assert(!mail.includes("person"), "email near the cut is still masked");   assertEquals(safeUrl("https://e.co.za/k/" + "a".repeat(40)), "https://e.co.za/k/…REDACTED", "short paths unchanged"); });

assertEquals(safeUrl("https://e.co.za/k/" + "a".repeat(40)), "https://e.co.za/k/…REDACTED", "short paths unchanged");

Deno.test("redos: one huge http script src, or thousands of them, stays fast", () => {   let t = performance.now();   const one = checkHtml(`<script src="http://cdn.example.co.za/${"a".repeat(1_400_000)}"></script>`, "https://e.co.za/");

let t = performance.now();   const one = checkHtml(`<script src="http://cdn.example.co.za/${"a".repeat(1_400_000)}"></script>`, "https://e.co.za/");   fast(performance.now() - t, 1_000, "1.4 MB src");

const one = checkHtml(`<script src="http://cdn.example.co.za/${"a".repeat(1_400_000)}"></script>`, "https://e.co.za/");

assertEquals(w12.length, 1);   assert(w12[0]!.evidence.length <= LIMITS.maxEvidence);   const many = `<script src="http://cdn.example.co.za/${"b".repeat(400)}"></script>`.repeat(3_000);

assert(w12[0]!.evidence.length <= LIMITS.maxEvidence);   const many = `<script src="http://cdn.example.co.za/${"b".repeat(400)}"></script>`.repeat(3_000);   t = performance.now();

const many = `<script src="http://cdn.example.co.za/${"b".repeat(400)}"></script>`.repeat(3_000);

t = performance.now();   const r = checkHtml(many, "https://e.co.za/");   fast(performance.now() - t, 1_500, "3000 http scripts");

const r = checkHtml(many, "https://e.co.za/");

const t = performance.now();   checkHeaders({     finalUrl: "https://e.co.za/",

checkHeaders({     finalUrl: "https://e.co.za/",     headers: new Headers({ server: "1".repeat(400_000), "x-powered-by": "9".repeat(400_000) }),

finalUrl: "https://e.co.za/",

});   fast(performance.now() - t, 100, "400 KB digit headers");   const v = checkHeaders({ finalUrl: "https://e.co.za/", headers: new Headers({ server: "nginx/1.25.3" }) });

fast(performance.now() - t, 100, "400 KB digit headers");   const v = checkHeaders({ finalUrl: "https://e.co.za/", headers: new Headers({ server: "nginx/1.25.3" }) });   assert(v.some((f) => f.rule_id === "WEB-009" && f.evidence === "nginx/

const v = checkHeaders({ finalUrl: "https://e.co.za/", headers: new Headers({ server: "nginx/1.25.3" }) });

const long = "/" + "c".repeat(300_000);   const m = mockFetch({     "https://example.co.za/": () => new Response(null, { status: 302, headers: { location: long } }),

const m = mockFetch({     "https://example.co.za/": () => new Response(null, { status: 302, headers: { location: long } }),     ["https://example.co.za" + long]: html("<p>ok</p>"),

"https://example.co.za/": () => new Response(null, { status: 302, headers: { location: long } }),

["https://example.co.za" + long]: html("<p>ok</p>"),

fast(performance.now() - t, 1_000, "long final URL");   const body = await res.json();   assertEquals(body.final_url, "https://example.co.za/…");

const body = await res.json();   assertEquals(body.final_url, "https://example.co.za/…"); });

assertEquals(body.final_url, "https://example.co.za/…");

let name = "";       try {         await guardedFetch("https://example.co.za/", ctx, { follow: true, bodyLimit: () => LIMITS.maxBodyBytes });

try {         await guardedFetch("https://example.co.za/", ctx, { follow: true, bodyLimit: () => LIMITS.maxBodyBytes });       } catch (e) {

await guardedFetch("https://example.co.za/", ctx, { follow: true, bodyLimit: () => LIMITS.maxBodyBytes });

for (     const u of [       "http://127%2e0%2e0%2e1/",

const u of [       "http://127%2e0%2e0%2e1/",       "http://127.0.0.1./",

"http://127%2e0%2e0%2e1/",

"http://127.0.0.1./",

"http://017700000001/",

"http://0x7f.0x0.0x0.0x1/",

"http://0.0.0.0./",

"http://[::]/",

"http://[::127.0.0.1]/",

"http://[0:0:0:0:0:ffff:127.0.0.1]/",

"http://[64:ff9b::169.254.169.254]/",

"http://[64:ff9b::a00:1]/",

"http://[2002:a9fe:a9fe::1]/",

"http://[2002:7f00:1::]/",

"http://[2001:0:4136:e378:8000:63bf:3fff:fdd2]/",

"http://[fec0::1]/",

"http://[fd00:ec2::254]/",

"http://１２７.０.０.１/",

"http://127。0。0。1/",

"http://ⓛⓞⓒⓐⓛⓗⓞⓢⓣ/",

"http://localhost%2e/",

"http://example.co.za\n@127.0.0.1/",

"https:////127.0.0.1/",

"http://168.63.129.16/",

"http://100.100.100.200/",

"http://metadata.google.internal./",

Deno.test("workers: every outbound fetch uses redirect manual, so a full check passes on Workers", async () => {   const modes: string[] = [];   const doh = (n: string, t: string) => `https://cloudflare-dns.com/dns-query?name=${n}&type=${t}

const modes: string[] = [];   const doh = (n: string, t: string) => `https://cloudflare-dns.com/dns-query?name=${n}&type=${t}`;   const json = (v: unknown) => () => new Response(JSON.stringify(v), { headers: { "content-type": "application/j

const doh = (n: string, t: string) => `https://cloudflare-dns.com/dns-query?name=${n}&type=${t}`;

[doh("example.co.za", "A")]: json({ Status: 0, Answer: [{ type: 1, data: "203.0.114.1" }] }),     [doh("example.co.za", "AAAA")]: json({ Status: 0 }),     "https://challenges.cloudflare.com/turnstile/v0/siteverify": json({ success: true }),

[doh("example.co.za", "AAAA")]: json({ Status: 0 }),     "https://challenges.cloudflare.com/turnstile/v0/siteverify": json({ success: true }),     "https://example.co.za/": () =>

"https://challenges.cloudflare.com/turnstile/v0/siteverify": json({ success: true }),

"https://example.co.za/": () =>

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

});   const res = await handler(     new Request("https://site.example.co.za/api/site-check", {

const res = await handler(     new Request("https://site.example.co.za/api/site-check", {       method: "POST",

new Request("https://site.example.co.za/api/site-check", {

method: "POST",       headers: { origin: "https://site.example.co.za", "content-type": "application/json" },       body: JSON.stringify({ url: "example.co.za", turnstileToken: "tok" }),

headers: { origin: "https://site.example.co.za", "content-type": "application/json" },

Executable file

#!/usr/bin/env bash

cleanup() { "${RUNAS[@]}" "$PGBIN/pg_ctl" -D "$WORK/data" -m immediate stop >/dev/null 2>&1 || true; rm -rf "$WORK"; }

1. Fork https://github.com/VenusOne-Lee/popia-compliance and create a branch, for example `i18n-zu-review`.

Executable file

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

Executable file

"license": "MIT",   "author": "Venus ARC (Pty) Ltd, trading as Venus One",   "homepage": "https://github.com/VenusOne-Lee/popia-compliance",

"author": "Venus ARC (Pty) Ltd, trading as Venus One",   "homepage": "https://github.com/VenusOne-Lee/popia-compliance",   "repository": {"type": "git", "url": "git+https://github.com/VenusOne-Lee/popia-compliance.git"},

"homepage": "https://github.com/VenusOne-Lee/popia-compliance",

"repository": {"type": "git", "url": "git+https://github.com/VenusOne-Lee/popia-compliance.git"},

1. **Open an issue first** at https://github.com/VenusOne-Lee/popia-compliance/issues with the sector, the main laws and who will maintain the pack.

[project.urls] Homepage = "https://popiakit.co.za"

Homepage = "https://popiakit.co.za"

"Site check" = "https://popiakit.co.za/check"

Repository = "https://github.com/VenusOne-Lee/popia-compliance"

Documentation = "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/quickstart.md"

Changelog = "https://github.com/VenusOne-Lee/popia-compliance/blob/main/CHANGELOG.md"

Security = "https://github.com/VenusOne-Lee/popia-compliance/blob/main/SECURITY.md"

Issues = "https://github.com/VenusOne-Lee/popia-compliance/issues"

function loadScript(src) { const s = document.createElement('script'); s.src = src; s.async = true; document.head.appendChild(s); }   function applyConsent(c) {     if (c?.analytics) loadScript('https://plausible.io/js/script.js');         

function applyConsent(c) {     if (c?.analytics) loadScript('https://plausible.io/js/script.js');            // or GA4 with consent mode     if (c?.marketing) { /* load Meta pixel, LinkedIn Insight, TikTok here, never before */ }

if (c?.analytics) loadScript('https://plausible.io/js/script.js');            // or GA4 with consent mode

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

python3 scripts/popia_scan.py ./repo --format json --out evidence/popia-scan.json # live site (passive) python3 scripts/site_check.py https://example.co.za --out evidence/site-check.md --json evidence/site-check.json

# live site (passive) python3 scripts/site_check.py https://example.co.za --out evidence/site-check.md --json evidence/site-check.json # extra tools if available

python3 scripts/site_check.py https://example.co.za --out evidence/site-check.md --json evidence/site-check.json

Severity:   Critical Title:      audit_leads table readable by anonymous users Evidence:   migration 20260712_create_leads.sql:4 creates table without RLS; curl with anon key returned 1,204 rows (redacted sample in evidence/F-07.txt)

Title:      audit_leads table readable by anonymous users Evidence:   migration 20260712_create_leads.sql:4 creates table without RLS; curl with anon key returned 1,204 rows (redacted sample in evidence/F-07.txt) Risk:       Any visitor can

Evidence:   migration 20260712_create_leads.sql:4 creates table without RLS; curl with anon key returned 1,204 rows (redacted sample in evidence/F-07.txt)

Base URL: `https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r`

# Consent system (provider, banner, gate, record helpers) npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-system.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-system.json

# Forms npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/marketing-opt-in.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/marketing-opt-in.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/collection-notice.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id-input.json

# Libraries npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/redact.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/redact.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json

# Account npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/privacy-centre.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/privacy-centre.json

# Supabase migrations and edge functions npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json

npx shadcn@latest add https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-functions.json

<App />   <GoogleConsentModeSync />   <ConsentGate category="analytics" src="https://plausible.io/js/script.js" scriptOptions={{ attributes: { "data-domain": "example.co.za" } }} />

<GoogleConsentModeSync />   <ConsentGate category="analytics" src="https://plausible.io/js/script.js" scriptOptions={{ attributes: { "data-domain": "example.co.za" } }} />   <ConsentBanner companyName="Example (Pty) Ltd" privacyNoticeUrl="/

<ConsentGate category="analytics" src="https://plausible.io/js/script.js" scriptOptions={{ attributes: { "data-domain": "example.co.za" } }} />

[Credential-related source omitted]

[Credential-related source omitted]

Add POPIA (South Africa) privacy features to this app using the open-source registry at https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/

https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/

supabase secrets set \      ALLOWED_ORIGINS="https://example.co.za,https://www.example.co.za" \

ALLOWED_ORIGINS="https://example.co.za,https://www.example.co.za" \

#!/usr/bin/env python3

SOURCE = HERE / "registry.json" OUT = HERE / "r" ITEM_SCHEMA = "https://ui.shadcn.com/schema/registry-item.json"

OUT = HERE / "r" ITEM_SCHEMA = "https://ui.shadcn.com/schema/registry-item.json" REGISTRY_SCHEMA = "https://ui.shadcn.com/schema/registry.json"

ITEM_SCHEMA = "https://ui.shadcn.com/schema/registry-item.json"

REGISTRY_SCHEMA = "https://ui.shadcn.com/schema/registry.json"

Executable file

[Credential-related source omitted]

objectionFormUrl,   privacyContact,   regulatorComplaintUrl = "https://inforegulator.org.za/", // VERIFY current complaints page

privacyContact,   regulatorComplaintUrl = "https://inforegulator.org.za/", // VERIFY current complaints page   retainedDataNote = "We keep some records after you delete your account where the law requires it, for example invoices for tax pu

regulatorComplaintUrl = "https://inforegulator.org.za/", // VERIFY current complaints page

[Credential-related source omitted]

if (!token) throw new Error("You need to be signed in.");       const res = await fetch(url(path), {         ...init,

const res = await fetch(url(path), {

Executable file

Executable file

*  * Usage:  *   <ConsentGate category="marketing" src="https://connect.facebook.net/en_US/fbevents.js" />

* Usage:  *   <ConsentGate category="marketing" src="https://connect.facebook.net/en_US/fbevents.js" />  *   <ConsentGate category="analytics" fallback={<p>Enable analytics cookies to see this.</p>}>

*   <ConsentGate category="marketing" src="https://connect.facebook.net/en_US/fbevents.js" />

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

Executable file

Executable file

[Credential-related source omitted]

const bin = atob(b64);

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

"label",     "switch",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"switch",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"   ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

"dependencies": [],   "registryDependencies": [     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"registryDependencies": [     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"   ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

{       "path": "popia/consent/consent-gate.tsx",       "content": "\"use client\";\n\n/**\n * ConsentGate, loadScript and Google Consent Mode v2 helpers.\n *\n * Nothing in the analytics or marketing category may load before the person\n *

"path": "popia/consent/consent-gate.tsx",       "content": "\"use client\";\n\n/**\n * ConsentGate, loadScript and Google Consent Mode v2 helpers.\n *\n * Nothing in the analytics or marketing category may load before the person\n * opts in

"content": "\"use client\";\n\n/**\n * ConsentGate, loadScript and Google Consent Mode v2 helpers.\n *\n * Nothing in the analytics or marketing category may load before the person\n * opts in. That covers pixels, tag managers, session repl

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

{       "path": "popia/consent/consent-gate.tsx",       "content": "\"use client\";\n\n/**\n * ConsentGate, loadScript and Google Consent Mode v2 helpers.\n *\n * Nothing in the analytics or marketing category may load before the person\n *

"path": "popia/consent/consent-gate.tsx",       "content": "\"use client\";\n\n/**\n * ConsentGate, loadScript and Google Consent Mode v2 helpers.\n *\n * Nothing in the analytics or marketing category may load before the person\n * opts in

"content": "\"use client\";\n\n/**\n * ConsentGate, loadScript and Google Consent Mode v2 helpers.\n *\n * Nothing in the analytics or marketing category may load before the person\n * opts in. That covers pixels, tag managers, session repl

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

"checkbox",     "label",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"

"label",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"   ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

"label",     "switch",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"switch",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"   ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

{       "path": "popia/account/privacy-centre.tsx",       "content": "\"use client\";\n\n/**\n * Privacy centre for signed-in users.\n *\n * Builds the data subject rights into the product (references/02-build-patterns.md, section 10):\n * 

"path": "popia/account/privacy-centre.tsx",       "content": "\"use client\";\n\n/**\n * Privacy centre for signed-in users.\n *\n * Builds the data subject rights into the product (references/02-build-patterns.md, section 10):\n *   - Down

[Credential-related source omitted]

[Credential-related source omitted]

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

[Credential-related source omitted]

{   "$schema": "https://ui.shadcn.com/schema/registry.json",

"$schema": "https://ui.shadcn.com/schema/registry.json",

"name": "popia",   "homepage": "https://github.com/VenusOne-Lee/popia-compliance",   "items": [

"homepage": "https://github.com/VenusOne-Lee/popia-compliance",

"label",         "switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"dependencies": [],       "registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"checkbox",         "label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"

"label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"

"input",         "label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"

"label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"

"label",         "switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"dependencies": [],       "registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"

"registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

"input",     "label",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"

"label",     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"   ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

"dependencies": [],   "registryDependencies": [     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"

"registryDependencies": [     "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"   ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"

[Credential-related source omitted]

[Credential-related source omitted]

{   "$schema": "https://ui.shadcn.com/schema/registry-item.json",

"$schema": "https://ui.shadcn.com/schema/registry-item.json",

{   "$schema": "https://ui.shadcn.com/schema/registry.json",

"$schema": "https://ui.shadcn.com/schema/registry.json",

"name": "popia",   "homepage": "https://github.com/VenusOne-Lee/popia-compliance",   "items": [

"homepage": "https://github.com/VenusOne-Lee/popia-compliance",

"label",         "switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"dependencies": [],       "registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"checkbox",         "label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"

"label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-record.json"

"input",         "label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"

"label",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/sa-id.json"

"label",         "switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"switch",         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/consent-provider.json"

"dependencies": [],       "registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"

"registryDependencies": [         "https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"       ],

"https://raw.githubusercontent.com/VenusOne-Lee/popia-compliance/main/registry/r/supabase-privacy-schema.json"

{   "user_agent": "popia-compliance-regwatch/1.0 (+https://github.com/VenusOne-Lee/popia-compliance; monthly check)",

"user_agent": "popia-compliance-regwatch/1.0 (+https://github.com/VenusOne-Lee/popia-compliance; monthly check)",

"id": "media-statements",       "name": "Information Regulator media statements",       "url": "https://inforegulator.org.za/media-statements/",

"name": "Information Regulator media statements",       "url": "https://inforegulator.org.za/media-statements/",       "enabled": true

"url": "https://inforegulator.org.za/media-statements/",

"id": "enforcement-notices",       "name": "Information Regulator enforcement notices",       "url": "https://inforegulator.org.za/enforcement-notices/",

"name": "Information Regulator enforcement notices",       "url": "https://inforegulator.org.za/enforcement-notices/",       "enabled": true

"url": "https://inforegulator.org.za/enforcement-notices/",

"id": "guidance-notes",       "name": "Information Regulator guidance notes",       "url": "https://inforegulator.org.za/guidance-notes/",

"name": "Information Regulator guidance notes",       "url": "https://inforegulator.org.za/guidance-notes/",       "enabled": true

"url": "https://inforegulator.org.za/guidance-notes/",

"media-statements": {       "seen": [         "https://inforegulator.org.za/wp-content/uploads/2026/09/Final-MEDIA-INVITE-INFORMATION-REGULATOR-HOSTS-THE-INTERNATIONAL-DAY-FOR-UNIVERSAL-ACCESS-TO-INFORMATION-IDUAI-SESSION-IN-TSHWANE.pdf",

"seen": [         "https://inforegulator.org.za/wp-content/uploads/2026/09/Final-MEDIA-INVITE-INFORMATION-REGULATOR-HOSTS-THE-INTERNATIONAL-DAY-FOR-UNIVERSAL-ACCESS-TO-INFORMATION-IDUAI-SESSION-IN-TSHWANE.pdf",         "https://inforegulato

"https://inforegulator.org.za/wp-content/uploads/2026/09/Final-MEDIA-INVITE-INFORMATION-REGULATOR-HOSTS-THE-INTERNATIONAL-DAY-FOR-UNIVERSAL-ACCESS-TO-INFORMATION-IDUAI-SESSION-IN-TSHWANE.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/08/MEDIA-INVITE-INFORMATION-REGULATOR-TO-HOST-MEDIA-BRIEFING-ON-HIGH-PROFILE-CASES-ENFORCEMENTS-AND-INVESTIGATIONS-INTO-POPIA-AND-PAIA-CONTRAVENTIONS.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/06/MEDIA-STATEMENT-INFORMATION-REGULATOR-ISSUES-ENFORCEMENT-NOTICES-FOR-THE-CONTRAVENTIONS-OF-POPIA-AND-PAIA-BY-PUBLIC-AND-PRIVATE-BODIES.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/06/MEDIA-INVITE-INFORMATION-REGULATOR-HOSTS-PROVINCIAL-ROADSHOW-IN-EASTERN-CAPE-TO-PROMOTE-POPIA-AND-PAIA.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/05/MEDIA-INVITE-INFORMATION-REGULATOR-HOSTS-PROVINCIAL-ROADSHOW-IN-EASTERN-CAPE-TO-PROMOTE-POPIA-AND-PAIA.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/05/Media-Alert-invitation-for-public-comment-on-POPIA-code-of-conduct-for-Gated-Access.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/04/INFORMATION-REGULATOR-TURNS-TO-THE-COURTS-TO-FINE-BLOUBERG-LOCAL-MUNICIPALITY-FOR-CONTRAVENTION-OF-POPIA_.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/04/MEDIA-STATEMENT-REGULATOR-NOTES-PUBLISHED-GAZETTE-OF-THE-CONSUMER-PROTECT-ACT-AMENDMENT-REGULATIONS-2026.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/02/APP-Stakeholder-Consultation-Session-Media-Invitation-final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/02/MEDIA-ADVISORY_PRETORIA-CONFERENCE-06022026.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/02/MEDIA-INVITE-IDPD-2026.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/01/MEDIA-STATEMENT-THE-REGULATOR-APPEALS-THE-JUDGEMENT-ON-PUBLICATION-OF-MATRIC-RESULTS-31-DEC-2025.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/01/MEDIA-STATEMENT-THE-REGULATOR-TO-STUDY-THE-COURT-JUDGEMENT-ON-MATRIC-RESULTS-December-2025.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/11/MEDIA-STATEMENT-INFORMATION-REGULATOR-WELCOMES-THE-FOCUS-ON-DATA-PROTECTION-and-TRANSPARENCY-COMMITMENTS-IN-THE-G20.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/11/Media-Briefing-Invite-Updates-on-POPIA-and-PAIA-matters-nz.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/10/Media-Statement-COURT-RESERVES-JUDGEMENT-ON-THE-MATTER-OF-THE-PUBLICATION-OF-MATRIC-RESULTS.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/10/Media-Statement-IDUAI-2025-Final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/09/Gov-Tech-Digital-Public-Service-Awards-Media-Statement-2025-final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/07/Final-Media-Invite-Dikopano-NW-2025-pdf.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/05/MEDIA-STATEMENT-RELOCATION-OF-INFORMATION-REGULATORS-OFFICES-final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/04/MEDIA-STATEMENT-INVITATION-TO-REPORT-SECURITY-COMPROMISES-THROUGH-THE-eSERVICES-PORTAL-.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/03/MEDIA-ALERT-SECTION-32-AND-83-4-PAIA-REPORTS.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/03/NOTICE-FOR-PAIA-ANNUAL-REPORT-2025.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/03/Media-Statement-IR-Welcomes-DOJ-CD-Minister-Decision-on-Sex-Offender-Register-Publishing-04-March-2025.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/03/Media-Invite-stakeholder-Engagement-Session-05-March-2025.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/01/MEDIA-INVITE-IDPD-2025.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/01/MEDIA-STATEMENT_-THE-SECURITY-COMPROMISE-AT-DBE-Final-1.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/01/FINAL-MEDIA-STATEMENT_INFORMATION-REGULATOR-and-DBE-MATRIC-RESULTS-COURT.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-INVITE-IDPD-2024-2.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-STATEMENT-IDPD-2024.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-STATEMENT_INFORMATION-REGULATOR-WINS-BCX-INNOVATION-AWARD.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT_INFORMATION-REGULATORS-LATEST-UPDATE-2.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/DIKOPANO-NORTHERN-CAPE-MEDIA-INVITE.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/IDUAI-Media-Statement-final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Media-Invite-for-Media-Briefing-PAIA-high-profile-cases-POPIA-progress.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-DIKOPANO-FREE-STATE-MEDIA-INVITE.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-IR-and-ESWATINI-COMMUNICATIONS-COMMISSION-MOU-MEDIA-STATEMENT.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ANIC-2024-MEDIA-STATEMENT-final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-ON-GUIDANCE-NOTE-ON-POLITICAL-PARTIES-AND-INDEPENDENT-CANDIDATES-FINAL-1.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Final-Media-Statement-PAIA-Annual-Report-Submission.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-INVITE-Regulator_-IEC-_-MMA-multisectoral-dialogue.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/UPDATED_MEDIA-INVITE-INFORMATION-REGULATOR-SHARES-OUTCOMES-ON-INVESTIGATIONS-ASSESSMENTS.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-INVITE-INFORMATION-REGULATOR-SHARES-OUTCOMES-ON-INVESTIGATIONS-ASSESSMENTS.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Media-Statement-on-the-IEC-Security-Compromise.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-ENFORCEMENT-NOTICE-ON-DIRECT-MARKETING-COMPLAINT.pdf",

"https://inforegulator.org.za/wp-content/uploads/2024/02/Public Notice Regarding Fraudulent activity.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/01/Media-Statement-Infringement-Notice-DBE.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Statement-on-privacy-and-democratic-rights.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-INVITE-FOR-THE-EASTERN-CAPE-DIKOPANO-and-STAKEHOLDER-ENGAGEMENT.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-ADVISORY_-IDUAI-2023.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-STATEMENT-ENFORCEMENT-NOTICE-ISSUED-TO-DISCHEM-PHARMACIES-LTD.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-ADVISORY_-MPUMALANGA-COMMUNITY-ENGAGEMENT18.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-INFRINGEMENT-NOTICE-ISSUED-TO-THE-DEPARTMENT-OF-JUSTICE-AND-CONSTITUTIONAL.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Extension-notice-for-submission-of-Annual-Report-to-the-Regulator-in-terms-of-section-32-and-section.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-THE-INFORMATION-REGULATOR-ELECTED-AS-EXECUTIVE-MEMBER-OF-A-GLOBAL-BODY.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-THE-REGULATOR-WELCOMES-THE-JUDGMENT-OF-THE-CONSTITUTIONAL-COURT-IN-FAVOUR-OF-TRANSPARENCY_.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-REGULATOR-CONDUCTS-PAIA-COMPLIANCE-ASSESSMENT-BY-POLITICAL-PARTIES.pdf",         "https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-ENFORCEMENT-N

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-ENFORCEMENT-NOTICE-ISSUED-TO-THE-DEPARTMENT-OF-JUSTICE-AND-CONSTITUTIONAL-DEVELOPMENT-DUE-TO-CONTRAVENTION.pdf",         "https://inforegulator.org.za/wp-content/uploa

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-INVITATION-TO-PUBLIC-and-PRIVATE-BODIES-TO-SUBMIT-ANNUAL-REPORTS-FOR-ACCESS-TO-INFO-REQUESTS-RECIEVED.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/pdf-Final-Version_MEDIA-BRIEFING-OF-INFORMATION-REGULATOR-ON-OUTCOMES-OF-RECEIVED-COMPLAINTS-003.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Media-Statement_Information-Regulator-Refers-NDOH-to-the-Enforcement-Committee.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Members-of-Parliament-demand-action-from-National-Treasury-on-independence-of-the-Information-Regulator_Approved.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Final-MEDIA-ADVISORY-INTERNATIONAL-DATA-PRIVACY-DAY-2023.pdf",

"https://inforegulator.org.za/wp-content/uploads/2022/11/MEDIA%20STATEMENT-%20THE%20REGULATOR%20COMMENDS%20THE%20DEPARTMENT%20OF%20BASIC%20EDUCATION%20FOR%20COMPLIANCE%20WITH%20POPIA%20AND%20OBTAINING%20CONSENT_.pdf",

"https://inforegulator.org.za/wp-content/uploads/2022/11/Media%20Statement_Information%20Regulator's%20Enforcement%20Committee_Zooms%20in%20on%20Municipalities_v2.pdf",

"https://inforegulator.org.za/wp-content/uploads/2022/11/Media%20Invite%20_%20AFRICA%20DIDGITAL%20RIGHTS%20HUB.pdf",

"https://inforegulator.org.za/wp-content/uploads/2022/10/Media%20Statement%20Regulator%20Approves%20Codes%20of%20Conduct%20for%20the%20Banking%20and%20Credit%20Reporting%20Sectors.pdf",

"https://inforegulator.org.za/wp-content/uploads/2022/10/MEDIA%20INVITE_%20KZN%20ROADSHOW%20Final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Media-Invite-IDUAI-28-September-2022.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Final-MEDIA-ALERT-_EXTENSION-FOR-SUBMISSION-OF-ANNUAL-REPORTS-IN-TERMS-OF-SECTION-32-of-PAIA-FOR-PUBLIC-BODIES.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/A-REMINDER-FOR-PUBLIC-BODIES-TO-SUBMIT-THEIR-ANNUAL-REPORT-IN-TERMS-OF-SECTION-32-OF-PROMOTION-OF-ACCESS-TO-INFORMATION-ACT-2-OF-2000-PAIA.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT_-REGULATOR-ISSUES-A-SUMMONS-AGAINST-SOUTH-AFRICAN-POLICE-SERVICE-.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-PUBLIC-HEARING-ON-ACCESS-TO-INFORMATION-ON-LICENSE-FEES-AND-COPYRIGHT-ROYALTIES-IN-THE-MUSIC-INDUSTRY.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-THE-REGULATOR-INITIATES-AN-ASSESSMENT-INTO-POSSIBLE-VIOLATIONS-OF-POPIA-FOLLOWING-ALLEGATIONS-TO-PERSONAL-INFORMATION-LEAKED-BY-SAPS-0.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Media-Statement_Information-Regulator-Establishes-Enforcement-Committee.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Final-MEDIA-STATEMENT-INFORMATION-REGULATOR-MONITORS-THE-DEPARTMENT-OF-HEALTHS-POPIA-COMPLIANCE-22-APRIL-2022.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-ANIC-14-APRIL-2022.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-THE-REGULATOR-IS-DISSATISFIED-WITH-TRANSUNIONS-RESPONSE-AND-IT-INITIATES-AN-ASSESSMENT_FINAL.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Human-Rights-Month-Webinar-Media-Statement-final.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-The-Regulator-instructs-TransUnion-to-report-in-greater-detail-regarding-their-security-compromise.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20220124-IDUAI-Webinar2021.pdf.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20220912-PublishingMatricResults.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20211202-appoints.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20211027-Experian.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20211014-ElectionCampaigning-POPIA.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210923-IDUAI-Webinar2021.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210913-ITsystems.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210713-ProcessingPersonalInfo.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210629-PAIA-SAHRC.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210622-Exemptions-LawfulProcessing.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210622-EnforcementPowers.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210401-GuidanceNote-IO.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210324-POPIA-Compliance.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ms-20210303-Whatsapp.pdf"

"enforcement-notices": {       "seen": [         "https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-SAPS-MATTER-04052363.pdf",

"seen": [         "https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-SAPS-MATTER-04052363.pdf",         "https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-HARDWICK-MATTER-04052375.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-SAPS-MATTER-04052363.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-HARDWICK-MATTER-04052375.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-DOJCD-MATTER-090523.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-IN-RESPECT-OF-THE-DEPARTMENT-OF-BASIC-EDUCATION-6-November-2024.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FT-RAMS-CONSULTING-ENFORCEMENT-NOTICE-210224_Redacted.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/DIS-CHEM-ENFORCEMENT-NOTICE.pdf",

"https://inforegulator.org.za/wp-content/uploads/2025/04/WHATS-APP-ENFORCEMENT-NOTICE.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/06/GAUTENG-DEPARTMENT-OF-HEALTH-ENFORCEMENT-NOTICE-080626.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/06/SIBANYE-STILLWATER-ENFORCEMENT-NOTICE-220526-003_Redacted.pdf",

"https://inforegulator.org.za/wp-content/uploads/2026/05/CJC-ENFORCEMENT-NOTICE-220526-redact_Redacted.pdf"

"guidance-notes": {       "seen": [         "https://inforegulator.org.za/wp-content/uploads/2020/07/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf",

"seen": [         "https://inforegulator.org.za/wp-content/uploads/2020/07/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf",         "https://inforegulator.org.za/wp-content/uploa

"https://inforegulator.org.za/wp-content/uploads/2020/07/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-GUIDANCE-NOTE-ON-THE-PROCESSING-OF-PERSONAL-INFORMATION-OF-VOTERS-AND-THE-COUNTERING-OF-MISINFORMATION-AND-DISINFORMATION-DURING-ELECTIONS.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/Guidance-Note-Processing-Special-PersonalInformation-20210628-004.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-Form-Application-form-for-authorisation-to-process-Special-Personal-Information-eForm-2021-1.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/GuidanceNote-Processing-PersonalInformation-Children-20210628-1.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-Form-Application-form-for-authorisation-to-process-Personal-Information-of-Children-eForm-2021-1.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-GuidanceNote-PPI-Covid19-20200403.pdf",

"https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-GuidanceNote-PPI-PolParties-1.pdf"

Executable file

#!/usr/bin/env python3

"```sql\n" + INVENTORY_SQL + "\n```\n\n"         "The same query and rules ship as `uvx popia-kit supabase sql` and `uvx popia-kit supabase check result.json`. "         "For the live site, use the free passive check at https://popiakit.co.

"For the live site, use the free passive check at https://popiakit.co.za/check.\n")

#!/usr/bin/env python3

popia-kit scan ./my-app                  code scanner (44 rules)     popia-kit operators ./my-app             third parties and the data sent to each     popia-kit site-check https://example.com passive live site check

popia-kit operators ./my-app             third parties and the data sent to each     popia-kit site-check https://example.com passive live site check     popia-kit supabase sql                   read-only Supabase database check

popia-kit site-check https://example.com passive live site check

#!/usr/bin/env python3

python3 scripts/popia_badge.py popia-scan.json --out popia-badge.svg     python3 scripts/popia_badge.py popia-scan.json --shields-json --out popia-badge.json     python3 scripts/site_check.py https://example.com --json site.json

python3 scripts/popia_badge.py popia-scan.json --shields-json --out popia-badge.json     python3 scripts/site_check.py https://example.com --json site.json     python3 scripts/popia_badge.py site.json --label "POPIA site check" --out site-b

python3 scripts/site_check.py https://example.com --json site.json

l, m = escape(label), escape(msg)     title = escape(f"{label}: {msg}")     return f"""<svg xmlns="http://www.w3.org/2000/svg" width="{total}" height="20" role="img" aria-label="{title}">

title = escape(f"{label}: {msg}")     return f"""<svg xmlns="http://www.w3.org/2000/svg" width="{total}" height="20" role="img" aria-label="{title}"> <title>{title}</title>

return f"""<svg xmlns="http://www.w3.org/2000/svg" width="{total}" height="20" role="img" aria-label="{title}">

#!/usr/bin/env python3

SAFE_CLONE_RX = re.compile(r"^(https://|git@[A-Za-z0-9.\-]+:)[^\s]+$")

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

Executable file; content unavailable

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

"[[VERIFY: Information Regulator contact details. Copy the current physical "     "address, postal address, complaints email, general enquiries email and website "     "from https://inforegulator.org.za. Do not copy details from old documen

"address, postal address, complaints email, general enquiries email and website "     "from https://inforegulator.org.za. Do not copy details from old documents or "     "other organisations' notices.]]"

"from https://inforegulator.org.za. Do not copy details from old documents or "

REPO_URL = "https://github.com/VenusOne-Lee/popia-compliance"

lines.append("")     lines.append("- **Information Regulator contact details** are a placeholder in every file that needs them. "                  "Copy the current details from https://inforegulator.org.za. This tool never supplies them.")

lines.append("- **Information Regulator contact details** are a placeholder in every file that needs them. "                  "Copy the current details from https://inforegulator.org.za. This tool never supplies them.")     vitems = _verify

"Copy the current details from https://inforegulator.org.za. This tool never supplies them.")

"trading_name": "Example Lodge",         "physical_address": "1 Example Road, Example Town, 0000, South Africa (fictional)",         "website": "https://examplelodge.example",

"physical_address": "1 Example Road, Example Town, 0000, South Africa (fictional)",         "website": "https://examplelodge.example",         "head_of_body": "Thandi Example (Managing Director)",

"website": "https://examplelodge.example",

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

})     return json.dumps({         "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",

})     return json.dumps({         "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",

return json.dumps({         "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",         "runs": [{"tool": {"driver": {"name": "popia_scan", "version": res["version"],

return json.dumps({         "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",         "runs": [{"tool": {"driver": {"name": "popia_scan", "version": res["version"],

"$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",

"$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",

"runs": [{"tool": {"driver": {"name": "popia_scan", "version": res["version"],                                       "informationUri": "https://github.com/VenusOne-Lee/popia-compliance",                                       "rules": rule_m

"runs": [{"tool": {"driver": {"name": "popia_scan", "version": res["version"],                                       "informationUri": "https://github.com/VenusOne-Lee/popia-compliance",                                       "rules": rule_m

"informationUri": "https://github.com/VenusOne-Lee/popia-compliance",

"informationUri": "https://github.com/VenusOne-Lee/popia-compliance",

Executable file

#!/usr/bin/env python3

DEFAULT_CONFIG = {     "user_agent": "popia-compliance-regwatch/1.0 (+https://github.com/VenusOne-Lee/popia-compliance)",

"user_agent": "popia-compliance-regwatch/1.0 (+https://github.com/VenusOne-Lee/popia-compliance)",

def fetch(url: str, ua: str, timeout: float) -> str:

if not url.startswith("https://"):         raise ValueError("regwatch sources must be https URLs")     req = urllib.request.Request(url, headers={"User-Agent": ua, "Accept": "text/html"})

req = urllib.request.Request(url, headers={"User-Agent": ua, "Accept": "text/html"})

with urllib.request.urlopen(req, timeout=timeout) as r:  # nosec B310

if n:                     time.sleep(delay)                 html = fetch(src["url"], ua, timeout)

time.sleep(delay)                 html = fetch(src["url"], ua, timeout)             res["items"] = extract_items(html, src["url"], config)

html = fetch(src["url"], ua, timeout)

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

Rule(         id="SEC-009", title="Unencrypted http:// endpoint", severity="medium", popia="s19",         pattern=r"""['"`]http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|www\.w3\.org|schemas\.|

id="SEC-009", title="Unencrypted http:// endpoint", severity="medium", popia="s19",         pattern=r"""['"`]http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|www\.w3\.org|schemas\.|xmlns|example\

pattern=r"""['"`]http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|www\.w3\.org|schemas\.|xmlns|example\.(com|org)|purl\.org|ns\.adobe)[^'"`\s]+""",

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

python3 site_check.py https://example.co.za [--out report.md] [--json report.json] [--timeout 15]

Programmatic:     from site_check import check, fmt_md     res = check("https://example.co.za")

res = check("https://example.co.za")

__version__ = "1.0.1" BOT_INFO_URL = "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/site-check-bot.md"

BOT_INFO_URL = "https://github.com/VenusOne-Lee/popia-compliance/blob/main/docs/site-check-bot.md"

hint = ("Scan your code instead, bot protection does not affect it: popia-kit scan . "             "Or add the POPIA Kit skill to your AI tool: "             "https://github.com/VenusOne-Lee/popia-compliance#whats-inside . "

"Or add the POPIA Kit skill to your AI tool: "             "https://github.com/VenusOne-Lee/popia-compliance#whats-inside . "             "If it is your site, you can allow the checker for one check: " + BOT_INFO_URL)

"https://github.com/VenusOne-Lee/popia-compliance#whats-inside . "

ctx = ssl.create_default_context()     _check_target(url, block_private)     req = urllib.request.Request(url, method=method, headers={"User-Agent": UA, "Accept": "text/html,*/*"})

req = urllib.request.Request(url, method=method, headers={"User-Agent": UA, "Accept": "text/html,*/*"})

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

{   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",

"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",

"title": "POPIA Kit",   "description": "POPIA privacy and security checks for South African apps: code scan, site check, guidance.",   "websiteUrl": "https://popiakit.co.za",

"description": "POPIA privacy and security checks for South African apps: code scan, site check, guidance.",   "websiteUrl": "https://popiakit.co.za",   "repository": {