Unawareness

Unawareness Analysis (LINDDUN U)

Analyze source code for unawareness threats where users do not know how their personal data is collected, processed, or shared. Failing to inform users violates transparency and may invalidate consent. This category has no STRIDE equivalent and is unique to privacy threat modeling.

Supported Flags

Read ../../shared/schemas/flags.md for full flag documentation. This skill supports all cross-cutting flags.

Framework Context

LINDDUN U -- Unawareness

Unawareness occurs when data subjects do not know how their personal data is collected, processed, or shared. Read ../../shared/frameworks/linddun.md for the full framework reference including transparency obligations and consent requirements.

Privacy Property Violated: Transparency / Informed Consent | STRIDE Mapping: No equivalent | OWASP: A04:2021 (Insecure Design)

Workflow

Step 1 -- Determine Scope

1. Parse --scope flag (default: changed).
2. Resolve to a concrete file list.
3. Filter to relevant files: data collection handlers, consent management modules, third-party SDK integrations, analytics initialization, user preference storage, data export/deletion endpoints, and privacy policy references.
4. Prioritize files containing: form submissions, registration flows, analytics setup, cookie management, third-party script loading, and user data APIs.

Step 2 -- Analyze for Unawareness Threats

Read each scoped file and assess whether users are informed about data practices:

1. Check consent flow ordering: Verify that consent is obtained before data collection begins -- not after or simultaneously.
2. Audit third-party integrations: Identify all third-party scripts, SDKs, and APIs that receive user data and verify disclosure.
3. Examine analytics initialization: Check whether analytics and telemetry start before the user has consented.
4. Look for data subject rights: Verify implementation of access, export, correction, and deletion endpoints.
5. Assess consent granularity: Check whether consent is all-or-nothing or granular by purpose.

At --depth deep or --depth expert, map every data collection point and verify each has a corresponding consent mechanism and privacy policy disclosure.

Step 3 -- Report Findings

Output findings per ../../shared/schemas/findings.md. Each finding needs: UNAWR-NNN id, title, severity (based on whether users are unaware of collection, sharing, or both), location with snippet, description of what data practice users are unaware of, impact (uninformed consent consequences), fix (consent gate, privacy notice, or user control), and CWE/LINDDUN references.

Analysis Checklist

1. Is analytics or telemetry initialized before the user consents to tracking?
2. Are there third-party scripts that receive user data without privacy policy disclosure?
3. Does a consent management system exist with granular opt-in/opt-out controls?
4. Can users access, export, and delete their personal data (data subject rights)?
5. Is there consent version tracking to prove what each user agreed to?
6. Are data collection purposes explained at the point of collection?
7. Are cookies set before the user interacts with a cookie consent banner?
8. Do dark patterns pressure users into accepting broader data collection?

What to Look For

1. Analytics before consent: Tracking scripts initialized before consent check.
   • Grep: gtag\(|analytics\.init|mixpanel\.init|segment\.load|amplitude\.init|posthog\.init
2. Missing consent management: No consent storage or preference system.
   • Grep: consent|cookie.consent|gdpr.consent|privacy.preference|opt.in|opt.out
3. Third-party scripts without disclosure: External services receiving user data.
   • Grep: <script.*src=.*third.party|import.*analytics|require.*tracking|facebook.*pixel|intercom
4. Missing data export endpoint: No user data portability implementation.
   • Grep: export.*data|download.*my.*data|data.portability|DSAR|subject.*access|getMyData
5. Missing data deletion endpoint: No right-to-erasure implementation.
   • Grep: delete.*account|erase.*data|remove.*user.*data|right.*forgotten|deleteMyData|purgeUser
6. Cookies set before consent: Cookie writes that execute before consent flow.
   • Grep: document\.cookie.*=|res\.cookie\(|setCookie|set-cookie|cookie\.set
7. Hidden data collection: Data gathered without visible user-facing disclosure.
   • Grep: navigator\.geolocation|getCurrentPosition|deviceId|device_id|collectTelemetry|beacon
8. Missing consent versioning: No tracking of what consent version users agreed to.
   • Grep: consent.*version|policy.*version|terms.*version|consent.*timestamp|consent.*date

Regulatory Mapping

Output Format

Use finding ID prefix UNAWR (e.g., UNAWR-001, UNAWR-002).

All findings follow the schema in ../../shared/schemas/findings.md with:

• references.cwe: CWE-1021 (Improper Restriction of Rendered UI Layers)
• references.owasp: A04:2021 (Insecure Design -- missing privacy by design)
• metadata.tool: "unawareness"
• metadata.framework: "linddun"
• metadata.category: "U"

Summary table after all findings:

| Unawareness Pattern          | Critical | High | Medium | Low |
|------------------------------|----------|------|--------|-----|
| Analytics before consent     |          |      |        |     |
| Missing consent management   |          |      |        |     |
| Undisclosed third-party data |          |      |        |     |
| Missing data export          |          |      |        |     |
| Missing data deletion        |          |      |        |     |
| Pre-consent cookies          |          |      |        |     |
| Hidden data collection       |          |      |        |     |

Followed by: top 3 priorities, transparency gap map, and overall assessment.