privacy

Hiding sensitive columns in the UI is not protection. The real mask lives in the API layer, proven by negative E2E assertions.

TL;DR: The article describes a common flaw where the UI hides sensitive fields but the API still sends full records to the client, violating OWASP API3:2023 and Indonesia's data minimization rules. The fix strips fields server-side via a projection DTO containing only public data. A Playwright test enforces negative assertions, ensuring PII never reaches the DOM.

Briefs headed to an external chatbot still carried hostnames and real repo names. A three-checkpoint mechanical gateway shut it.

TL;DR: Internal data was leaking to an external LLM, an architecture flaw not a prompt issue. The fix is a three-stage gateway that rewrites real identities to fictional ones before the model sees them, blocks pushes with real tokens, and scans published posts. It uses reserved example domains and doc IPs, and found seven leaks in 564 articles.

ChatGPT memory is not a real-time summary of your sessions. I break down the real mechanism: periodic synthesis, system prompt injection, and the privacy cost.

TL;DR: ChatGPT doesn't scan your chat history with RAG. Instead, it periodically synthesizes your conversations into a static profile injected into every new session's system prompt, including roughly your last 40 typed messages. Since deleting one chat won't erase derived insights, treat memory as a managed archive, not a perfect record.