Spot the Leak
You’re handed a mock checkout screen — a receipt, a URL, a couple of server log lines. Some of those fields quietly expose sensitive data: a full card number where only the last four should show, an email sitting in the page URL, a secret API key baked into the client-side JavaScript. Tap the ones you think leak, then hit reveal. The tool grades your tags the way a machine-learning classifier is graded — precision, recall, and F1 — paints a leak-severity heatmap on the screen, and names the exact reason each field leaks. Runs entirely in your browser (0 uploads, works offline).
How to use it
- Read the mock screen and tap every field or log line you believe exposes private data. Tap again to untag.
- Press Reveal the leaks to score your tags — precision, recall, and F1 appear, and each real leak lights up by severity.
- Open the X-ray panel to see the leaks you missed, each with the concrete reason it leaks, plus any safe fields you flagged by mistake.
- Copy or share your score — catching six of six with zero false alarms is a bragging-rights number.
What this clears up (the fundamentals)
- A leak is a specific mechanism, not a vibe — a full PAN on a receipt breaks PCI-DSS, PII in a URL bleeds into logs and Referer headers, a key in client JS is simply public. Naming the mechanism turns "this feels risky" into a fix.
- Precision and recall pull in opposite directions — flag everything and you catch all the leaks (high recall) but drown in false alarms (low precision). Flag only what you’re sure of and precision climbs while misses cost you recall. F1 balances the two.
- False alarms have a cost — tagging the product name or a masked card as a leak isn’t harmless; it wastes review time and trains people to ignore the alarm. Being right about what’s safe matters as much as spotting the danger.
- Severity ranks the fix — a leaked API key or password burns hotter than a displayed date of birth. You triage by heat, fixing the critical exposure before the merely-untidy one.
Where it's used
A free, no-signup teardown that makes data-leak review click — the fastest way to feel why a privacy review is a precision/recall problem, not a checklist. It’s a miatz build-lab concept playable: play it here, then learn to build the ground-truth board, the classifier scoring, and the severity heatmap yourself.
FAQ
What counts as a "leak" here?
Any field or log line that exposes sensitive or private data to someone who shouldn’t see it — a full card number, an email in a URL, a plaintext password in a log, a session token in the page source, a date of birth, or a secret key shipped in client-side code. Product names, order statuses, and masked cards are safe by design.
How is my score calculated?
Your tags are graded as a binary classifier against a fixed answer key. Leaks you tag are true positives, leaks you miss are false negatives, and safe fields you tag are false positives. Precision is TP / (TP + FP), recall is TP / (TP + FN), and F1 is their harmonic mean. It’s a deterministic rubric — no model call, no randomness.
Why does flagging a safe field hurt my score?
Because it’s a false positive. Precision measures how many of your tags were actually leaks, so every safe field you flag drags precision below 1 — even if you also caught every real leak.
What does the heatmap mean?
Each real leak is shaded by a fixed severity model, so a leaked API key or password reads hotter than a shown date of birth. It ranks where to start, turning "several things are wrong" into an ordered fix list.
Is anything uploaded?
No. The mock screen and the answer key are baked into the page; your tags are graded entirely in your browser — nothing is transmitted, stored, or logged. Turn off your Wi-Fi and it still works.
Limits
This is a teaching board built from precomputed, illustrative data — nine fixed fields and a hand-set answer key with hand-assigned severities. It is not a live scanner and does not inspect a real page, model, or system. Real leak review depends on context, data volume, and regulation; the classification lens it teaches (precision, recall, severity triage) is exactly the real practice, but the specific screen is a fixed example, not a live model.
Related
Part of the Demystify Playgrounds. Explore the rest from the Playgrounds home.
Bookmark this page (Ctrl+D, or ⌘D on Mac) — it works offline the next time you need it.