Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Cross-Border Transfers and Breach Readiness: Cloud Regions, LLM Providers, Standard Contracts and the 72-Hour Notification
A transfer abroad is not only where the server is; logs, backups, e-mail, analytics and LLM prompts are transfers too, and since 2024 they must rely on an adequacy decision, an appropriate safeguard such as a standard contract, or an occasional case. On Bookstore we keep the sub-processor inventory in code, check the five-business-day notification of standard contracts at start-up, and use an access log to get a breach's scope and the 72-hour deadline within the first hour.
Privacy Notices, Explicit Consent and Cookies: Recording Consent, Cookie Banners, Consent Mode and Commercial Message Permissions (İYS)
A privacy notice is given for every processing activity, while explicit consent is obtained separately and only where processing relies on it; consent must be provable, versioned and revocable. On Bookstore we build an append-only ConsentRecord, an Angular banner with equal buttons following the Authority's cookie guide, Google Consent Mode with a denied default, Playwright tests that verify them, and reporting commercial e-mail permissions to İYS within three business days.
Personal Data in Logs, Telemetry and Analytics: URLs, Exception Messages, IP Addresses, Session Replay and Error Reporting Tools
Personal data rarely enters logs through a LogInformation call; it gets in through an e-mail address in the URL, a record passed to a log message, an exception message, a span tag or a metric label. On Bookstore's checkout flow we show these leaks with real output, lock them down with a test that searches for canary values, clean browser error reports, truncate IP addresses and add telemetry to the inventory.
Retention, Deletion and Anonymisation: "Delete My Account", Soft Delete, Backups, Caches and the Periodic Destruction Job
A "delete my account" request is not one DELETE but a separate decision for every piece of data: the profile is erased, orders are detached from the person and kept for the legal period, then anonymised. On Bookstore we show the foreign key pitfall, why soft delete is not enough, how each copy is erased, the periodic destruction job, the destruction log and how an erasure ledger stops erased customers from returning after a backup restore, with real output.
Protecting Personal Data: Always Encrypted, Application-Level Encryption, Pseudonymisation, Masking and Test Data
The way to protect a sensitive personal data field is to choose the layer by threat: TDE protects the disk, Always Encrypted the DBA, application-level AES-GCM the backups and replicas, and masking only the screen. On Bookstore we encrypt the invoice national ID with purpose-bound AES-GCM, search it with an HMAC blind index, show it masked to support and move test environments to synthetic data with deliberately invalid IDs generated by Bogus.
Personal Data Inventory and Privacy by Design: Classifying Data, Marking It in Code and Minimisation
The technical half of a personal data inventory can be generated from code: we classify entities with Microsoft.Extensions.Compliance attributes and derive tables, columns, purposes, retention periods and copies from the EF Core model. A test that catches unclassified fields, a SQL Server sensitivity label script, minimisation decisions such as an age confirmation instead of a birth date, PCI DSS and LINDDUN on Bookstore, with real output.
KVKK and GDPR for Developers: Personal Data, Special Categories, Controllers/Processors and the Principles That Shape Code
Personal data is any information that another record can tie to a person, so hashed e-mail addresses, IP addresses and device IDs are personal data too. We cover the definitions of Turkey's Law 6698 and the GDPR, controllers versus processors, the endpoints behind data subject rights, what Law 7499 changed in 2024 and the KVKK–GDPR differences on Bookstore, with code that was run and primary sources; not legal advice.
End to End: Security Gates, Exception Handling and Metrics in the Bookstore Pipeline
A quiet security pipeline runs only the checks a developer can fix within minutes on the PR and the deep checks on main; fixable critical and high findings fail, and the rest are tracked through exceptions with an owner and an expiry date. With real output we show Bookstore's single workflow, a gate that catches an expired exception, vulnerability age and MTTR, OpenSSF Scorecard and the mapping of the controls to the OWASP Top 10:2025.
Signing and Provenance: Sigstore, Artifact Attestations and SLSA v1.2
An image signature proves the content has not changed and who signed it, and provenance proves which repo, workflow and commit produced it; both only help if they are verified at deploy time. We verify keyless Sigstore signatures and GitHub attestations on real releases, bind an SBOM attestation to the Bookstore image, reject unsigned and tag-referenced images with Kyverno, and assess the pipeline against SLSA v1.2.
SBOM and VEX: Knowing What You Ship with CycloneDX 1.7 and SPDX 3
An SBOM is the machine-readable list of components in a release, and its real value is querying which version of which product is affected when a new CVE arrives, without building anything; VEX then states, with a justification, whether it is affected. For Bookstore we produce and verify .NET, Angular and image SBOMs, query them in Dependency-Track and apply OpenVEX and CycloneDX VEX with real output.
DAST: Scanning a Running Application with ZAP — Baseline, API Scan and Authenticated Scanning
DAST sends requests to the running application from outside and finds behavioral flaws such as headers, cookies, error leaks and reflected input; but it only scans the endpoints it can reach and cannot see authorization bugs. We scan Bookstore.Api with ZAP 2.17 using baseline, API scan and an Automation Framework plan, and show with real output how to catch a dropped session in a token-based scan, turn findings into integration tests and run DAST on main.
Container and IaC Scanning: Image Vulnerabilities, Base Image Choice and Manifest Scanning
Image scanning checks the operating system packages and the application dependencies of the artifact you actually deploy; most findings come from unused packages, and a chiseled, non-root base image removes most of them. With real output we show the Bookstore image dropping from 42 findings to 6, how Trivy and Grype differ, verifying the scanner with a SHA pin and a cosign signature after the March 2026 Trivy incident, and Dockerfile, Kubernetes and Terraform scanning.