# Picking the right Source Code Repositories

### Overview

When selecting which source code repositories to scan, it is crucial to prioritize those that handle sensitive and personal data. This guide outlines key categories of repositories to consider, helping ensure that your scanning efforts are both efficient and effective.

#### Repositories Handling User Data

**Authentication and Authorization Services**: These repositories manage critical aspects of user login, signup, and access control, often processing sensitive information such as usernames, passwords, and personal identifiers.

**User Profile Management**: Repositories in this category handle user profiles, preferences, and settings, storing personal data like names, addresses, contact information, and user-specific settings.

#### Repositories Interacting with External Services

**APIs and Micro-services**: These repositories include API endpoints and microservices that exchange data with external services or third-party vendors, frequently involving the transfer of personal information.

**Integration Services**: Repositories that integrate with third-party services such as payment processors, email services, or analytics providers. These require careful monitoring due to the nature of data transfers involved.

#### Repositories Processing Transactional Data

**E-commerce Platforms**: Repositories related to e-commerce activities, including shopping cart systems, order processing, and payment gateways, often processing personal data such as payment details and shipping addresses.

**Financial Systems**: These repositories handle financial transactions, invoices, and billing information, typically dealing with sensitive personal and financial data.

#### Repositories with Logging and Monitoring

**Logging Services**: Repositories implementing logging and monitoring functionalities, which can sometimes inadvertently capture personal data, necessitating careful scanning for potential data leaks.

**Analytics and Reporting**: Repositories that collect and analyze user behavior, performance metrics, and other data, often containing user identifiers and personal information.

#### Repositories Handling Communication

**Messaging and Notification Systems**: Repositories managing various communication channels, such as email, SMS, and push notifications, which use personal contact information to send messages.

**Customer Support Systems**: Repositories for customer support functionalities, including ticketing systems and live chat applications, processing user queries and related personal data.

#### Repositories Related to Sensitive Industries

**Healthcare Applications**: These repositories handle medical records, patient information, and other sensitive health data.

**Education Platforms**: Repositories for educational software managing student records, course enrolments, and other academic information.

#### Additional Considerations

**Active Development**: Prioritize repositories that are continuously updated, ensuring they incorporate the latest security measures and features.

**Large and Multi-team Repositories**: Large repositories or those being developed by multiple teams may contain hidden risks and Personally Identifiable Information (PII), requiring thorough vetting and continuous monitoring.