## Appendix A Prompts Used in the Analysis Pipeline  
### The Prompt for Detecting Sensitive Elements in the Component Code  
Inspect the following Angular code, list all variables or attributes that could contain sensitive information for the user (usernames, passwords, email addresses, physical addresses, phone numbers, birthdates, social security numbers, credit card numbers, bank account numbers, routing numbers, driver's license numbers, passport numbers, health insurance numbers, medical records, IP addresses, biometric data, purchase history, tax IDs, company confidential information, employee IDs, salary information, private messages or chats, security questions and answers, location data, photographs, educational records, cookies, browser history, user behavior data, web server logs, API keys, encryption keys, cloud storage keys, OAuth tokens, cryptocurrency wallets, session IDs, device IDs, personal identification numbers (PINs), legal documents, employment history, marital status, family information, religious affiliation, sexual orientation, political views, racial or ethnic origin, trade union membership), their origin (meaning, how it is retrieved--user input, database, service or storage--in the latter case you must include the exact name of the service or storage), and function in a CSV format. In the function, try to include what happens with the attribute in the code, how it is stored, where it is forwarded Be concise! Avoid redundancy, for example, if an object contains sensitive attributes, you do not need to include them individually, just include the object and in its function mention that it contains email address, password, etc. The code is as follows, separated by three backticks: \"(text)\"In your answer, use this CSV format:  
Element; Type; Level; Origin; ServiceName; Function; Goal; GoalName; Classname  
Where the Element is the name of the sensitive element, the Type is its type based on the list above i.e., username, password, email address, etc., the reason why this element is identified as sensitive. The Level is a numeric value from 1-3, signifying how sensitive this information is. A value of 1 means low severity, such as browser history, user behavior, cookies, or the identifiers of such information; 2 means medium severity such as username, email, password, birthdate, IP address, location data, political/religious views, sexual orientation, etc. ; 3 means high severity, information that might lead to identity theft, financial loss, or significant privacy invasion such as social security number, health insurance, drivers license, legal documents, passport, medical information, credit card data, encryption keys, tax IDs. The Origin is one of the following values: ('UserInput', 'LocalStorage', 'Service') The ServiceName is the name of the service from where the element came if the value of the Origin is'service', else its an empty string. The Function is a description of what the given element is used for. The Goal is where the element is forwarded, stored, what happens to it, it must be one of the following values: ('read','stored','service'). The GoalName is the name of the service the element is forwarded to if the value of the Goal field was'service'. The Classname is the name of the Angular class where the element was detected. For example:  
\"  
customersArrayData; CustomerInformation;2; Service; DbServiceService;Array of Customer objects containing sensitive information about the customers; Read; ; CustomerSComponent  
id; User Identifier; 1; UserInput; Id to query a Customer object from the database;Used to call the GetCustomer function of the DbServiceService; Service, DbServiceService; CustomerSComponent  
\"  
Your answer must include only the CSV format and nothing else! If there are no sensitive elements in the file, your answer must be exactly 'There are no sensitive elements in the file' The element and variable names in the files might not be English!