PARADE stands for Processing Activity Risk Assessment Diagramming Environment. The premise is simple - a dataflow diagram, embedded with security and privacy controls and metadata, can answer all the questions in a security or privacy risk assessment. Why dataflow diagrams? Because risk follows dataflow. And because a picture really is worth a thousand words, especially in this context.
Early feedback told me that nobody wants to create another artifact from scratch. So my first priority has been to build out a code-scan-to-diagram pipeline which allows you to bootstrap diagrams using our CLI tool (https://github.com/DataParade-io/dataparade-cli)
This is what the CLI tool does today: - Point the CLI at a repo, and it writes a dataflow.json you can import as a starting diagram in the DataParade app. After the scan, you will see a link to our web app where you can further manipulate the diagram, continue annotating it with security and privacy properties, and add more nodes, data transfers, and actors.
- No paywall. I'm just looking to stress-test the scanner across real codebases right now and get general feedback; maybe identify some design partners along the way.
- It currently parses TypeScript, JavaScript, Python, and Terraform (Java/Go on deck).
- The scan runs locally. By default, the resulting diagram is uploaded to a workspace so you get a link to open it in the app (use the --skip-auto-upload flag to keep it fully local).
- .env files never get read.
- We don't point an LLM at your repo and hope. A deterministic pattern engine derives your dataflow diagram directly from the code. An optional AI pass enriches it and cites evidence for every suggestion; or use the --no-ai-inference flag for deterministic-only output with zero model calls.
- The optional AI enrichment runs through our platform, so anonymous AI scans are rate-limited (to keep costs sane during this stress test). If you hit the limit, add the --no-ai-inference flag to keep going structurally, or grab a workspace key.
- Open source, GPL-3.0: https://github.com/DataParade-io/dataparade-cli
My ask: I’m looking for feedback on scans/diagrams across a wide range of architectures and technologies…
- Is your diagram missing a service?
- Did it draw a flow backwards?
- Did it choke on your monorepo?
- What other languages/frameworks would you like to see supported?
- Any other suggestions on how we can make DataParade awesome?
The more stacks we see, the more robust DataParade becomes.
I look forward to reading through your feedback in these comments (both good and bad).
Thank you in advance!