CARBON — Engineering ConfidenceUser Guide
CHAPTER 23 / 60 Pro

/carbon-privacy

Run focused CARBON Privacy testing and generate a branded privacy report.

Pete · PrivacySecurity & resilience

When to use it

You need to understand where personal data goes.

Before you start

Use synthetic values to trace collection, processing, storage, analytics and deletion. Review retention and consent separately. Do not put real customer data into a shareable example report.

Try this in your coding agent.

/carbon-privacy Trace what customer data the checkout flow collects, stores and sends.

Replace sample paths with your project. Slash names are shorthand; your host may use a plugin prefix or a skill picker. Invocation help →

ILLUSTRATIVE WALKTHROUGH

Checkout data flow

An expanded teaching example, not a recorded or live execution. The report stays visible while the replay explains how to read it.

  1. 01Read context
  2. 02Investigate
  3. 03Show evidence
  4. 04Report

Coding-agent conversation

Read context

I’m reviewing checkout data flow. I’ll keep the scope and permissions explicit.

Investigate

Follow the weakest evidence link and record what remains blocked.

Show evidence

Here is the evidence trail to inspect: Synthetic email field → event payload trace → third-party analytics sink.

Report

An analytics payload includes an unnecessary email address. Retention and processor settings require separate access and review.

CARBON

Example report

Illustration
Trace the data boundary
Trace the data boundary — TestBucks teaching screen

TestBucks course screen with illustrative analysis. The screenshot supplies context; the demo does not establish a newly observed bug.

  1. Synthetic input
  2. Processing boundary
  3. Allowed destination

Illustrated outcome

An analytics payload includes an unnecessary email address.

Evidence to inspect

Synthetic email field → event payload trace → third-party analytics sink.

Still untested / not established

Retention and processor settings require separate access and review.

Ready. Read the full example or play its steps.

What a useful result contains

A bounded claim

For checkout data flow, state the target, revision, environment and actual work performed. Keep planned, executed, blocked and untested work separate.

An inspectable trail

Synthetic email field → event payload trace → third-party analytics sink. In a real run, retain the source, trace, screenshot or fixture behind the conclusion.

The qualification

Retention and processor settings require separate access and review.

The next decision

Decide whether the evidence calls for a focused check, a reviewed fix or more context. Do not convert a plausible example into a verified finding.

Adapt the example to your project

  1. Replace checkout data flow with a real feature, path or decision in your project.
  2. State the expected rule and its source. Include safe fixtures, constraints and a budget where appropriate.
  3. Ask for exact evidence and remaining gaps. Approve consequential actions separately.
/jay Review the /carbon-privacy result. Separate observed evidence, assumptions and untested scope, then recommend the next useful check.

Where to go next

/carbon-data →/carbon-security →

Content checked against the local command definition: skills/carbon-privacy/SKILL.md. Examples adapted from the homepage’s TestBucks walkthroughs. Availability is edition- and host-dependent.