Free source-code scanner

vDPO Privacy Scanner

Identify what personal data the inspected code handles, with evidence of collection paths, storage and recipients.

  1. Install the plugin in your AI coding assistant.
  2. Run it inside a codebase you are authorised to inspect.
  3. Receive one self-contained local HTML report with personal-data categories, collection paths, destinations, third parties, and file-and-line evidence.
Download free scanner

Version 1.1.0 · Free-use proprietary licence · No account required

Why source code matters

The form is only part of the story.

A page may visibly ask for a name and email while its backend also records an IP address, user agent, session identifier, analytics event, device signal, or AI prompt. A surface-level website scan may never see those collection paths.

Surface scan

What the interface shows

Forms, visible cookies, page text, and scripts exposed to a browser.

vDPO Privacy Scanner

What the code handles

Request metadata, logs, schemas, SDK calls, storage operations, data pipelines, AI integrations, and third-party destinations.

Example scan

Evidence, not assumptions

Every reported collection point shows why it was identified and where the evidence appears.

AI coding assistant 
❯ Scan this codebase and report what personal data it collects.

⏺ Tracing request inputs, schemas, logs, SDKs, storage and third-party calls…

✓ Confirmed · IP address is read from the incoming request and written to the authentication log.
  src/auth/login.ts:48–53

✓ Confirmed · Email address and account ID are sent with analytics identify events.
  src/analytics/identify.ts:21–27

◐ Inferred · Device-token column exists, but no active write path was found in the inspected scope.
  db/migrations/014_devices.sql:8

✓ Report created: .vdpo-privacy-scanner/html/index.html
Your output

One focused personal-data collection report

The free scanner delivers one self-contained HTML report of technical facts found in the selected codebase. No separate data file is needed to view or share it. The report is saved locally; source-code processing depends on your AI assistant and its configuration. Local output does not guarantee offline analysis. JSON export is available on request for integrations. It does not produce a privacy policy or make a compliance determination.

Included

  • Confirmed, inferred, and unknown collection points
  • Provided, observed, derived, and generated data
  • Personal-data categories and people concerned
  • Storage locations, logs, queues, and destinations
  • Third-party services visible in the code path
  • Exact file and line evidence
  • File coverage, exclusions, limitations and open questions
  • Verified evidence locations, excerpts and file hashes
  • Changes since a previous HTML report
  • Search, filters, reviewer notes and optional copies without source excerpts

Not included

  • Privacy-policy generation
  • Legal or jurisdiction-specific conclusions
  • Compliance certification or scoring
  • Security-standard assessments
  • DPIAs, ROPAs, remediation plans, or policy packs

Those require the complete vDPO Auditor workflow and human review.

Installation

Use it with your coding assistant

Download once, unzip the package, and install the same scanning skill in the environment you use to work with your authorised code.

OpenAI

Codex

  1. Unzip the package.
  2. Attach the extracted folder in a new Codex task.
  3. Ask Codex to install and validate vDPO Privacy Scanner in your personal plugin marketplace.
  4. Open the authorised repository and ask it to scan for personal-data collection.
PromptScan this codebase and report what personal data it collects.
Anthropic

Claude Code

  1. Unzip the package.
  2. Run ./install-claude-code.sh from the extracted folder for persistent installation.
  3. Restart Claude Code and open the authorised repository.
  4. Ask it to run vDPO Privacy Scanner.
One-off useclaude --plugin-dir /absolute/path/to/vdpo-privacy-scanner
GitHub

VS Code Copilot

  1. Unzip the package.
  2. Copy skills/scan-personal-data into .github/skills/ in the repository or ~/.copilot/skills/ for personal use.
  3. Open VS Code chat in agent mode.
  4. Ask Copilot to use the scan-personal-data skill.
PromptUse scan-personal-data to inspect this repository.
SST

OpenCode

  1. Unzip the package.
  2. Copy skills/scan-personal-data into .opencode/skills/ in the repository or ~/.config/opencode/skills/ for personal use.
  3. Start OpenCode in the authorised repository.
  4. Ask it to scan the codebase for personal-data collection.
Output.vdpo-privacy-scanner/html/index.html
Free-use proprietary licence

Free to use. Not free to resell.

You may use the scanner personally or inside your organisation. You may not resell, redistribute, white-label, offer it as a service, or use it to build a competing commercial product. The complete licence is included in the download.

Version 1.1.0

Don’t guess what your product collects. Ask your code.

Download vDPO Privacy Scanner