Keamanan dan Privasi Sistem Absensi Siswa Berbasis Biometrik dan Geolokasi: Tinjauan Sistematis Prisma 2020 dan Studi Kasus Audit Sistem Open-Source

Abstract

Schools are adopting attendance systems that combine face recognition, live photographs and GPS geofencing, processing children's biometric and location data, yet evaluations mostly measure accuracy. This study maps how the security and privacy of such systems are evaluated and tests that picture on a real deployment. We combine a PRISMA 2020 systematic review of Scopus, Web of Science, IEEE Xplore and the ACM Digital Library (2015–2026) with a static security audit of an open-source PHP/MySQL attendance system piloted with 36 students at an Indonesian public high school, mapped to the OWASP Top 10:2025. The audit found 22 issues (4 critical, 6 high, 8 medium, 4 low), including a face-login authentication bypass, disclosure of face descriptors, SQL injection and forgeable geofencing, although internal QA had rated the system production-ready. We identify an assurance gap and propose a minimum security and privacy baseline aligned with Indonesia's Personal Data Protection Law.