0.3.1 - 2026-10-14

Release Notes

The Fides fragment lists every destination personal data reaches, including those the code
does not name, and declared processors are named by their declaration. The analysis is
unchanged: for the same input, 0.3.1 reports the same flows and findings as 0.3.0.

Changed

• Fides output: egress to a destination the code does not name (a host computed at run time, a
  model provider chosen by configuration) is a DataFlow with a placeholder key,
  unresolved_<sink class>_<file>, per sending file, with its categories and call sites. It was
  a closing comment, so a scan without processors: in .privacy-flow.yml wrote egress: []
  for services such as eShop.

Fixed

• A processor declared by sink ID or host is named by its declaration in egress and the Fides
  output. A declaration matched by sinks: for a sink the catalogue gives no processor
  (Microsoft.Extensions.AI, the Vercel AI SDK) was labelled ?, and without a fides_key it
  was left out of the Fides egress. A processor declared by hosts: is keyed by its name
  (acme_crm), not the host it matched.

Install privacy-flow 0.3.1

Install prebuilt binaries via Homebrew

brew install noru-tech/tap/piiflow

Download privacy-flow 0.3.1

File	Platform	Checksum
privacy-flow-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
privacy-flow-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
privacy-flow-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
privacy-flow-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo noru-tech/privacy-flow

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> --repo noru-tech/privacy-flow