Build a CodeQL Query Pack to Catch Logging of Personal Data
Overview
What this challenge is about.
Build a CodeQL Query Pack to Catch Logging of Personal Data. Advanced challenge in code. Writing production code that solves real engineering problems, earn ...
The Brief
What you'll do, and what you'll demonstrate.
Application code routinely writes personal data into logs, and the vendor's scanner cannot yet catch it with enough precision to ship the rule to customers.
This is not a coding exercise. It is the work a software engineer does between a Jira ticket and a merged PR. That distinction matters to every hiring manager who has seen candidates solve LeetCode problems and none who have shipped production code under real constraints.
When you finish, you will have something most graduates do not: a real-world deliverable, verified by Ewance, that you can show to a hiring manager and say "I did this. Here is the proof."
Earning criteria — what you'll demonstrate
- Model personal-data sources and logging sinks as CodeQL data-flow configurations across two languages
- Apply taint-tracking sanitizers to suppress false positives from hashed or redacted values
- Measure and interpret precision and recall against a labeled benchmark
- Diagnose and classify why a static-analysis rule misses true cases (e.g. data passed through reflection)
- Communicate precision/recall tradeoffs and known gaps to a security-engineering audience
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Static Analysis
Apply static analysis to solve real industry problems and demonstrate production-level capability.
- Codeql
Apply codeql to solve real industry problems and demonstrate production-level capability.
- Data Flow Analysis
Apply data flow analysis to solve real industry problems and demonstrate production-level capability.
- Taint Tracking
Apply taint tracking to solve real industry problems and demonstrate production-level capability.
- Java Programming
Apply java programming to solve real industry problems and demonstrate production-level capability.
- Python Programming
Apply python programming to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
Static Analysis Engineer
Authoring and tuning a precision-driven CodeQL rule across two languages mirrors the core work of building detection content for a code-scanning product, where you balance false positives against coverage and defend the rule with measured results.
This challenge sharpens
- codeql
- static-analysis
- data-flow-analysis
Application Security Engineer
Detecting personal data leaking into logs and modeling sanitizers is everyday application-security work, bridging taint analysis with real compliance risk in Java and Python services that AppSec teams secure in CI pipelines.
This challenge sharpens
- taint-tracking
- java-programming
- python-programming
Product Security Researcher
Designing a source/sink model, validating it on a benchmark, and documenting its blind spots is the research loop behind shipping new scanner capabilities, turning a vague customer gap into a measured, defensible detection rule.
This challenge sharpens
- static-analysis
- data-flow-analysis
- taint-tracking