Is there a standard process anywhere for vetting some software for information leakage? I would imagine that someone would deploy the software behind an MITM pr

Is there a standard process anywhere for vetting some software for information leakage? I would imagine that someone would deploy the software behind an MITM proxy and then look at the traffic, but it would be nice if there was some standard process or framework for this somewhere.