ethereum / ethereum/esp-website

Verify Opportunity Name field doesn't contain PII

Open
#508 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
67
Forks
54
PR merge metrics
No merged PRs in 30d

Description

## Problem

The Grants Explorer publicly displays the Salesforce Opportunity `Name` field as the project name. Depending on how ESP names Opportunities, this could contain personal names, legal entity names, or other identifying information not intended for public display.

The `Name` field is the standard Opportunity name — often auto-generated or set by internal staff — and may follow naming conventions that embed personal information (e.g., "John Doe - Protocol Research").

If Opportunity names contain PII, this is a GDPR/CCPA exposure.

## Action Needed

Confirm with the Salesforce admin that the Opportunity `Name` field is always a project name (not a person's name) for the record types in `PUBLIC_RECORD_TYPES` (`Sponsorships`, `Proactive community grants`, `Financial support`, `Matching funds`).

**If not safe:** Consider using a dedicated `Public_Project_Name__c` custom field, or adding a boolean `Approved_For_Public_Display__c` gate.

## Context

- Code: `src/lib/sf/grants.ts` line 181 — `projectName: record.Name`
- All grant data is serialized into `__NEXT_DATA__` (page source), making the full dataset scrapable
- PR #497

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at src/lib/sf/grants.ts line 181 and trace how record.Name is assigned for the PUBLIC_RECORD_TYPES records and serialized into __NEXT_DATA__. Confirm with the Salesforce admin whether those Opportunity names can contain PII, reviewing PR #497 for context. Done means documenting that the field is safe or deciding on a dedicated public-name field or approval gate.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.