Close Open Privacy Scan

link https://github.com/samuelgursky/davinci-resolve-mcp
bolt Snapshot: commit 8d83166
science engine v1.22
schedule 2026-07-22T12:10:55.080638+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy MCP server detected: @modelcontextprotocol/sdk — detected in dependencies, not a safety judgment.

App Privacy Score

82 /100
Low privacy risk

Low risk · 209 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

egress −15
env_fs −3

list Scan Summary

0 high 0 medium 209 low
First-party packages: 1
Dependency packages: 1
Ecosystem: python

swap_horiz External domains

api.github.comen.wikipedia.orgeternallyconfuzzled.comgithub.comjson-schema.orgollama.comopencode.aipyaaf.readthedocs.iostuk.github.iowww.bradfordoperations.comwww.samuelgursky.comwww.w3.org

</> First-Party Code

first-party (python)

python first-party
expand_more 201 low-confidence finding(s)
low env_fs production #b6da0b7a4e5a42d5 — Environment-variable access.
repo/install.py:50 
    if os.environ.get("NO_COLOR"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85f654eee8a6e5bc — Environment-variable access.
repo/install.py:53 
        return os.environ.get("WT_SESSION") or os.environ.get("TERM_PROGRAM")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a7683c12990364cb — Environment-variable access.
repo/install.py:232 
    username = os.environ.get("USER", os.environ.get("USERNAME", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92e192b89d45661f — Environment-variable access.
repo/install.py:283 
    return Path(os.environ.get("APPDATA", home() / "AppData" / "Roaming"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8918da6661e41c1b — Environment-variable access.
repo/install.py:287 
    return Path(os.environ.get("XDG_CONFIG_HOME", home() / ".config"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9eab4b8277e2f2aa — Filesystem access.
repo/install.py:598 
        with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b389e3adfd6f2233 — Filesystem access.
repo/install.py:627 
    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4435e6b4bd87a813 — Environment-variable access.
repo/install.py:780 
    env = {**os.environ, **build_server_env(python_path, api_path, lib_path)}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3bb17911c33c039 — Filesystem access.
repo/install.py:901 
            with open(path, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a752f7789cf73bd — Filesystem access.
repo/install.py:914 
        with open(tmp_path, "w", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ae3edbdd0a18b822 — Filesystem access.
repo/install.py:928 
        with open(server_path, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #96a98e374699629f — Filesystem access.
repo/install.py:1111 
        with open(history_path, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a89649f2119a9684 — Filesystem access.
repo/install.py:1191 
        with open(path, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6064052899f3d371 — Environment-variable access.
repo/install.py:1442 
        env_api = os.environ.get("RESOLVE_SCRIPT_API")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c5e55263ec0d6bae — Filesystem access.
repo/scripts/audit_api_parity.py:52 
    text = docs_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1e8a0b6cf7e7fd10 — Filesystem access.
repo/scripts/audit_api_parity.py:89 
            parts.append(py_path.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c93c1e8d19c4e6ff — Filesystem access.
repo/scripts/audit_api_parity.py:103 
            for i, line in enumerate(py_path.read_text().splitlines(), 1):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bd80bd8d2bde6a3a — Filesystem access.
repo/scripts/audit_api_parity.py:202 
            for i, line in enumerate(py_path.read_text().splitlines(), 1):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3d23ec46d187abef — Filesystem access.
repo/scripts/audit_readwrite_symmetry.py:64 
    src = open(SERVER, encoding="utf-8").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2afa6c3829e00140 — Environment-variable access.
repo/scripts/doctor.py:29 
    env_repo = os.environ.get("DAVINCI_MCP_REPO")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d50ce45105591593 — Environment-variable access.
repo/scripts/doctor.py:40 
PYTHON = Path(os.environ.get("DAVINCI_MCP_PYTHON", REPO / "venv" / "bin" / "python")).expanduser()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dd9f6e1280a5118e — Environment-variable access.
repo/scripts/doctor.py:46 
CODEX_HOME = Path(os.environ.get("CODEX_HOME", "~/.codex")).expanduser()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7d8aaa1d8a3f03b4 — Environment-variable access.
repo/scripts/doctor.py:49 
    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #41356bbf54b61682 — Environment-variable access.
repo/scripts/doctor.py:49 
    os.environ.get(
        "CLAUDE_DESKTOP_CONFIG",
        "~/Library/Application Support/Claude/claude_desktop_config.json",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8f4b0400ec2e44c4 — Environment-variable access.
repo/scripts/doctor.py:54 
RESOLVE_APP = Path(os.environ.get("RESOLVE_APP", "/Applications/DaVinci Resolve/DaVinci Resolve.app"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #93ebabcff6a53a13 — Environment-variable access.
repo/scripts/doctor.py:56 
    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ba830710988f19dc — Environment-variable access.
repo/scripts/doctor.py:56 
    os.environ.get(
        "RESOLVE_SCRIPT_API",
        "/Library/Application Support/Blackmagic Design/DaVinci Resolve/Developer/Scripting",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2fdf2c147234dacf — Environment-variable access.
repo/scripts/doctor.py:61 
RESOLVE_MODULES = Path(os.environ.get("RESOLVE_SCRIPT_MODULES", RESOLVE_API / "Modules"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2b10798fdb7b26e7 — Environment-variable access.
repo/scripts/doctor.py:63 
    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eee4465cd1220592 — Environment-variable access.
repo/scripts/doctor.py:63 
    os.environ.get(
        "RESOLVE_SCRIPT_LIB",
        "/Applications/DaVinci Resolve/DaVinci Resolve.app/Contents/Libraries/Fusion/fusionscript.so",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0f3d698b1cf3f6db — Filesystem access.
repo/scripts/doctor.py:103 
    text = path.read_text(errors="replace")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cae69b150c6afa23 — Filesystem access.
repo/scripts/doctor.py:113 
    match = re.search(r'^VERSION\s*=\s*"([^"]+)"', SERVER.read_text(errors="replace"), re.M)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7415abfce1b2640c — Environment-variable access.
repo/scripts/doctor.py:154 
        **os.environ,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #29b1afdb7cc42a6f — Filesystem access.
repo/scripts/gen_api_limitations.py:128 
        current = DOC_PATH.read_text() if DOC_PATH.exists() else ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f21e31f9e6a603b7 — Filesystem access.
repo/scripts/gen_api_limitations.py:138 
    DOC_PATH.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #69274554a1a47b8b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/scripts/regen_panel_screenshots.py:28 
    with urllib.request.urlopen(f"{base}/api/clips", timeout=10) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #c191de95405db377 — Environment-variable access.
repo/src/analysis_dashboard.py:11828 
                modules_path = os.environ.get("RESOLVE_SCRIPT_API")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #659351812d18f554 — Filesystem access.
repo/src/analysis_dashboard.py:13018 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9886b1413f538fe4 — Filesystem access.
repo/src/analysis_dashboard.py:13395 
        with open(artifacts["analysis_json"], "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #78b04a325d20cd09 — Filesystem access.
repo/src/analysis_dashboard.py:13436 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d181ec8361e4bc3d — Filesystem access.
repo/src/analysis_dashboard.py:13613 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b8022ec7269bbbf0 — Filesystem access.
repo/src/analysis_dashboard.py:14180 
            with open(pkg_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3bcb097ffef8ba7f — Filesystem access.
repo/src/analysis_dashboard.py:14631 
        with open(os.path.join(log_dir, ".mcp_restart_needed"), "w", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #487c28dee058873e — Filesystem access.
repo/src/analysis_dashboard.py:14647 
        with open(path, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a6a5594c70491cf3 — Filesystem access.
repo/src/analysis_dashboard.py:14798 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d0358e3b297a09e — Filesystem access.
repo/src/analysis_dashboard.py:14960 
            with open(path, "rb") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #73f06ab6d32f78de — Filesystem access.
repo/src/analysis_dashboard.py:15305 
                with open(full, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #832024c2dd1f0129 — Environment-variable access.
repo/src/analysis_dashboard.py:15643 
            os.environ["DAVINCI_RESOLVE_MCP_UPDATE_CHANNEL"] = channel

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d75242eedf3eaf52 — Environment-variable access.
repo/src/granular/common.py:63 
RESOLVE_API_PATH = os.environ.get("RESOLVE_SCRIPT_API") or paths["api_path"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32d410f02b825e8a — Environment-variable access.
repo/src/granular/common.py:64 
RESOLVE_LIB_PATH = os.environ.get("RESOLVE_SCRIPT_LIB") or paths["lib_path"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #848f101251be5a1d — Environment-variable access.
repo/src/granular/common.py:70 
    os.environ["RESOLVE_SCRIPT_API"] = RESOLVE_API_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #47fd3cd60e6219ff — Environment-variable access.
repo/src/granular/common.py:72 
    os.environ["RESOLVE_SCRIPT_LIB"] = RESOLVE_LIB_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aab13dc22a49f3bb — Environment-variable access.
repo/src/resolve_mcp_server.py:17 
api_path = os.environ.get("RESOLVE_SCRIPT_API") or paths["api_path"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d8a8e45f698b2c3 — Environment-variable access.
repo/src/resolve_mcp_server.py:18 
lib_path = os.environ.get("RESOLVE_SCRIPT_LIB") or paths["lib_path"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f571f18674534a17 — Environment-variable access.
repo/src/resolve_mcp_server.py:22 
    os.environ["RESOLVE_SCRIPT_API"] = api_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d3c4feac43a08b02 — Environment-variable access.
repo/src/resolve_mcp_server.py:24 
    os.environ["RESOLVE_SCRIPT_LIB"] = lib_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d57dd572c9f319a6 — Environment-variable access.
repo/src/server.py:132 
os.environ["RESOLVE_SCRIPT_API"] = RESOLVE_API_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b95a37433303008 — Environment-variable access.
repo/src/server.py:133 
os.environ["RESOLVE_SCRIPT_LIB"] = RESOLVE_LIB_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a7a650e3d2c0aa26 — Environment-variable access.
repo/src/server.py:768 
        if not os.environ.get("PYTHONHOME"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0befef24d376499 — Environment-variable access.
repo/src/server.py:769 
            os.environ["PYTHONHOME"] = sys.base_prefix

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45badcd7771d05ab — Environment-variable access.
repo/src/server.py:772 
        _cur_path = os.environ.get("PATH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #04fcc004750eb0e2 — Environment-variable access.
repo/src/server.py:774 
            os.environ["PATH"] = _resolve_install_dir + os.pathsep + _cur_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f4bedc057850ff7f — Filesystem access.
repo/src/server.py:5308 
    with open(path, "wb") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #24e51bfd40463c9a — Filesystem access.
repo/src/server.py:5328 
    with open(metadata_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0dc5cec3045905e8 — Environment-variable access.
repo/src/server.py:8122 
    override = os.environ.get(_MEDIA_ANALYSIS_PREFS_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1903855077594f8a — Filesystem access.
repo/src/server.py:8146 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d512cfa60e895d3 — Filesystem access.
repo/src/server.py:8164 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d656ccb26f0a18e0 — Filesystem access.
repo/src/server.py:8185 
        with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b8dbcf670a0cebc — Filesystem access.
repo/src/server.py:10361 
                with open(report_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b3eb2f955cf4840 — Filesystem access.
repo/src/server.py:10431 
                with open(report_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #474a8c5b13fecf9e — Filesystem access.
repo/src/server.py:11994 
        with open(update_state_path(project_dir), "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #644d960498b81b01 — Filesystem access.
repo/src/server.py:12015 
        with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c5f0da8f1537235d — Environment-variable access.
repo/src/server.py:12027 
    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b5ce74e60b0de602 — Filesystem access.
repo/src/server.py:13001 
            with open(analysis, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #75e3f4622a6d6512 — Filesystem access.
repo/src/server.py:13014 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe4b68fab4476406 — Filesystem access.
repo/src/server.py:13036 
        with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #38b4bd546d3ff8c1 — Filesystem access.
repo/src/server.py:13318 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #0d3a8b5842da5efa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/server.py:13410 
        with urllib.request.urlopen(url, timeout=timeout) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #1bb9c070e1f38e1c — Filesystem access.
repo/src/server.py:13571 
        log_handle = open(log_path, "a", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #befe8b3fa42c1f2b — Filesystem access.
repo/src/server.py:13602 
                with open(log_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2bc79409f609383a — Filesystem access.
repo/src/server.py:13644 
        with open(_control_panel_pidfile(), "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8cab49caefe4813b — Filesystem access.
repo/src/server.py:22123 
                with open(fpath, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1994f056a61aadb9 — Filesystem access.
repo/src/server.py:23842 
                with open(full, "r", encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #46009729ec296f5d — Filesystem access.
repo/src/server.py:23866 
            with open(path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #996d8c328c1ce905 — Filesystem access.
repo/src/server.py:23897 
            with open(path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1c60220a34038b5 — Filesystem access.
repo/src/server.py:24123 
                with open(full, "r", encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #589c3abc8df74b08 — Filesystem access.
repo/src/server.py:24160 
            with open(path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cf662d49e49f6699 — Filesystem access.
repo/src/server.py:24215 
            with open(target, "r", encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fadec1c2f02569e6 — Environment-variable access.
repo/src/server.py:24318 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dac81b74ebf9afe6 — Filesystem access.
repo/src/server.py:24534 
        with open(path, "r", encoding="utf-8", errors="replace") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f3b596537d629071 — Filesystem access.
repo/src/server.py:24683 
        with open(path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ad776342d1c26ca — Filesystem access.
repo/src/server.py:25090 
                    with open(full, "r", encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2beedb6e757ce160 — Filesystem access.
repo/src/server.py:25130 
            with open(path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3504d3d4ccb76ba3 — Filesystem access.
repo/src/server.py:25182 
            with open(target, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a1e444aa7367513 — Filesystem access.
repo/src/server.py:25402 
        with open(registry_path, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd6edd4544f6fe2c — Filesystem access.
repo/src/utils/analysis_memory.py:102 
            with open(path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #193e8e15214a2385 — Filesystem access.
repo/src/utils/analysis_memory.py:122 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d44fc2478d46f1ed — Filesystem access.
repo/src/utils/analysis_memory.py:137 
        with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8526cde390e48ccd — Filesystem access.
repo/src/utils/analysis_memory.py:215 
                with open(analysis_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e071f659b2801ee — Filesystem access.
repo/src/utils/analysis_memory.py:365 
        with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aafb862cca315b30 — Filesystem access.
repo/src/utils/analysis_memory.py:418 
        with open(analysis_json_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #422d69e25ce93d5b — Filesystem access.
repo/src/utils/analysis_memory.py:443 
        with open(path, "a", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a625078fa1a476c7 — Filesystem access.
repo/src/utils/analysis_memory.py:476 
        with open(path, "a", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #551e51a81b67b71b — Filesystem access.
repo/src/utils/analysis_memory.py:500 
        with open(path, "a", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9769996f5f40637a — Filesystem access.
repo/src/utils/analysis_memory.py:537 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a1841d740c6b9699 — Filesystem access.
repo/src/utils/analysis_memory.py:569 
        with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8b6f5899a6f89f1b — Filesystem access.
repo/src/utils/analysis_memory.py:610 
            with open(path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #51de85efa4c5dc8f — Filesystem access.
repo/src/utils/analysis_memory.py:629 
                with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d9013c38a56e037 — Filesystem access.
repo/src/utils/analysis_memory.py:660 
        with open(path, "a", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #376ec247cf66bce4 — Filesystem access.
repo/src/utils/analysis_store.py:223 
            with open(report_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53d836fc86575321 — Filesystem access.
repo/src/utils/analysis_store.py:945 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c4d6e5cc9a3a181 — Filesystem access.
repo/src/utils/analysis_store.py:994 
                with open(report_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8211413eed41d58c — Filesystem access.
repo/src/utils/audio_fairlight_live_probe.py:252 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #583a98a276a03e48 — Filesystem access.
repo/src/utils/audio_fairlight_live_probe.py:253 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b8ec3450a817e6a — Filesystem access.
repo/src/utils/brain_edits.py:351 
            with open(path, "r") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #28921a796a38b753 — Filesystem access.
repo/src/utils/brain_edits.py:371 
    with open(tmp_path, "w") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bdd94c5abfdc2947 — Filesystem access.
repo/src/utils/brain_edits.py:382 
        with open(path, "r") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0361924a51b27ab — Filesystem access.
repo/src/utils/color_grade_live_probe.py:433 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23f31481f7f15c2b — Filesystem access.
repo/src/utils/color_grade_live_probe.py:434 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3c0b15219967e5c1 — Filesystem access.
repo/src/utils/deep_vision.py:559 
                    with open(report_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e2d1e36792e2e8c — Filesystem access.
repo/src/utils/edit_engine.py:69 
    with open(tmp, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #70d71fee2ea75605 — Filesystem access.
repo/src/utils/edit_engine.py:78 
        with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e72d55349e274878 — Filesystem access.
repo/src/utils/edit_engine.py:127 
    with open(tmp, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e30f53711462b88 — Environment-variable access.
repo/src/utils/embeddings.py:38 
OLLAMA_URL = os.environ.get("DAVINCI_RESOLVE_MCP_OLLAMA_URL", "http://127.0.0.1:11434")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7373114ee52dd601 — Environment-variable access.
repo/src/utils/embeddings.py:39 
OLLAMA_TEXT_MODEL = os.environ.get("DAVINCI_RESOLVE_MCP_EMBED_MODEL", "nomic-embed-text")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #65f2f566c1e2ca7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/utils/embeddings.py:106 
        with urllib.request.urlopen(f"{OLLAMA_URL}/api/tags", timeout=_PROBE_TIMEOUT_SECONDS) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #7c10e5899324549d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/utils/embeddings.py:207 
    with urllib.request.urlopen(request, timeout=_EMBED_TIMEOUT_SECONDS) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #08d94389df5ecdf1 — Filesystem access.
repo/src/utils/entities.py:140 
    with open(tmp, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cc8be3186c89c2e9 — Filesystem access.
repo/src/utils/entities.py:147 
        with open(_detection_state_path(project_root), "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #75593a8726b9afe0 — Filesystem access.
repo/src/utils/entities.py:559 
            with open(path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2b39ed8d1a1d16bb — Filesystem access.
repo/src/utils/entities.py:576 
    with open(tmp, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19eb32946bc2044a — Filesystem access.
repo/src/utils/extension_authoring_live_probe.py:281 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f61243aa5b7ada96 — Filesystem access.
repo/src/utils/extension_authoring_live_probe.py:282 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca826d44d74c8262 — Filesystem access.
repo/src/utils/fusion_composition_live_probe.py:273 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8219d8d3053c7661 — Filesystem access.
repo/src/utils/fusion_composition_live_probe.py:274 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #62cf4aecde7ed35c — Filesystem access.
repo/src/utils/fusion_group_settings.py:206 
    with open(path, encoding="utf-8", errors="replace") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af9234fc846402c8 — Filesystem access.
repo/src/utils/fusion_group_settings.py:232 
    with open(template_path, encoding="utf-8", errors="replace") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3ce43a0c74b9ccc9 — Filesystem access.
repo/src/utils/fusion_group_settings.py:292 
    with open(source_path, encoding="utf-8", errors="replace") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7c2d33d120a05f5a — Filesystem access.
repo/src/utils/fusion_group_settings.py:311 
        with open(tmp_path, "w", encoding="utf-8", newline="\n") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a2c128fe766720a4 — Environment-variable access.
repo/src/utils/lut_paths.py:31 
        programdata = os.environ.get("PROGRAMDATA", r"C:\ProgramData")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #27d9115f8908ddd9 — Environment-variable access.
repo/src/utils/mcp_transport.py:32 
    tok = os.environ.get("DAVINCI_MCP_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d32ad265fab81536 — Filesystem access.
repo/src/utils/mcp_transport.py:59 
        with open(TRANSPORT_STATE_PATH, "w", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4706da64df9de83 — Filesystem access.
repo/src/utils/mcp_transport.py:87 
        with open(TRANSPORT_STATE_PATH, encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b00cdfc0a2a7b44d — Environment-variable access.
repo/src/utils/mcp_transport.py:104 
    host = os.environ.get("DAVINCI_MCP_HOST") or mcp.settings.host or "127.0.0.1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #194d89bfca518991 — Environment-variable access.
repo/src/utils/mcp_transport.py:105 
    port = int(os.environ.get("DAVINCI_MCP_PORT") or mcp.settings.port or 8000)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d436cfaa9e3f4335 — Environment-variable access.
repo/src/utils/media_analysis.py:343 
    current = os.environ.get("PATH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e0c6c65dab3d533 — Environment-variable access.
repo/src/utils/media_analysis.py:348 
        os.environ["PATH"] = os.pathsep.join(additions + parts) if parts else os.pathsep.join(additions)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94507f2281a29c97 — Filesystem access.
repo/src/utils/media_analysis.py:1531 
            with open(os_release, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21a401bf23487c71 — Environment-variable access.
repo/src/utils/media_analysis.py:1611 
    env = env if env is not None else os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f762be54d0eef45 — Filesystem access.
repo/src/utils/media_analysis.py:2280 
        with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0431b2f19e8a46ec — Filesystem access.
repo/src/utils/media_analysis.py:2292 
    with open(path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8de416c9f39824bc — Filesystem access.
repo/src/utils/media_analysis.py:3325 
        with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9f79d1e872b339fa — Filesystem access.
repo/src/utils/media_analysis.py:5276 
                with open(existing_report["path"], "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b710e9f509609048 — Filesystem access.
repo/src/utils/media_analysis.py:5653 
        with open(corrections_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d973fe07da2dd00 — Filesystem access.
repo/src/utils/media_analysis.py:5736 
            with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64b572f5a70bcb2c — Filesystem access.
repo/src/utils/media_analysis.py:5856 
            with open(analysis_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #88ce2a46f78130f1 — Filesystem access.
repo/src/utils/media_analysis.py:5901 
        with open(analysis_json_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f636ba1d9cb8e48 — Filesystem access.
repo/src/utils/media_analysis.py:7030 
                with open(corrections_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c587be5607a03c4a — Filesystem access.
repo/src/utils/media_analysis_jobs.py:254 
    with open(tmp_progress, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a662b5e40601b40 — Filesystem access.
repo/src/utils/media_analysis_jobs.py:269 
    with open(tmp_events, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d0aab8fd00df9fd9 — Filesystem access.
repo/src/utils/media_pool_ingest_live_probe.py:141 
    unsupported.write_text("synthetic non-media boundary fixture\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #63f94b9d54ed269b — Filesystem access.
repo/src/utils/media_pool_ingest_live_probe.py:581 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3196a9a3a1101226 — Filesystem access.
repo/src/utils/media_pool_ingest_live_probe.py:582 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cafd48260b47fff2 — Filesystem access.
repo/src/utils/page_lock.py:52 
                _fh = open(_LOCKFILE, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #497a22503adba4ee — Environment-variable access.
repo/src/utils/platform.py:39 
        program_files = os.environ.get('PROGRAMDATA', 'C:\\ProgramData')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad02a065b0b4c770 — Environment-variable access.
repo/src/utils/platform.py:40 
        program_files_64 = os.environ.get('PROGRAMFILES', 'C:\\Program Files')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e179b0f457bcbc79 — Environment-variable access.
repo/src/utils/platform.py:94 
        appdata = os.environ.get('APPDATA', os.path.join(home, 'AppData', 'Roaming'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa47ac63698188ca — Environment-variable access.
repo/src/utils/platform.py:146 
        os.environ["RESOLVE_SCRIPT_API"] = paths["api_path"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5bbaaf6608b21893 — Environment-variable access.
repo/src/utils/platform.py:147 
        os.environ["RESOLVE_SCRIPT_LIB"] = paths["lib_path"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a6478d9e44c9be5 — Filesystem access.
repo/src/utils/project_lifecycle_live_probe.py:364 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a40e9f43528206a4 — Filesystem access.
repo/src/utils/project_lifecycle_live_probe.py:365 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #20b6a0df5cb4e0b1 — Filesystem access.
repo/src/utils/project_spec.py:188 
    with open(path, "r", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #56f2374776d38e6a — Filesystem access.
repo/src/utils/render_deliver_live_probe.py:371 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f114d621149e0a8 — Filesystem access.
repo/src/utils/render_deliver_live_probe.py:372 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1dec5bc05c36c552 — Filesystem access.
repo/src/utils/resolve_busy.py:63 
        with open(_SIDECAR, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #382b9af80e1d6b8b — Filesystem access.
repo/src/utils/resolve_busy.py:83 
        with open(tmp_path, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #341dd9080fc49c36 — Filesystem access.
repo/src/utils/resolve_busy.py:98 
        with open(_SIDECAR, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d5fed13f726b47d — Environment-variable access.
repo/src/utils/resolve_connection.py:59 
    resolve_script_api = os.environ.get("RESOLVE_SCRIPT_API")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4aa5330302443227 — Environment-variable access.
repo/src/utils/resolve_connection.py:60 
    resolve_script_lib = os.environ.get("RESOLVE_SCRIPT_LIB")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f49fb8e734e31cb5 — Filesystem access.
repo/src/utils/review_annotation_live_probe.py:341 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c48a061bc183dac — Filesystem access.
repo/src/utils/review_annotation_live_probe.py:342 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10c4a1a369110c71 — Filesystem access.
repo/src/utils/shot_relationships.py:93 
    with open(tmp, "w", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e201e78502534a6f — Filesystem access.
repo/src/utils/shot_relationships.py:100 
        with open(_state_path(project_root), "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d7a6c5ad53f45bae — Filesystem access.
repo/src/utils/timeline_conform_live_probe.py:269 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71807fb8a2f03829 — Filesystem access.
repo/src/utils/timeline_conform_live_probe.py:270 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b9c583e4b5d36d6 — Filesystem access.
repo/src/utils/timeline_kernel_live_probe.py:957 
        api_text = Path("docs/reference/resolve_scripting_api.txt").read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #035ef8b3acb92d91 — Filesystem access.
repo/src/utils/timeline_kernel_live_probe.py:1087 
    json_path.write_text(json.dumps(report, indent=2, sort_keys=True, default=str), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1bcae1c232b05136 — Filesystem access.
repo/src/utils/timeline_kernel_live_probe.py:1088 
    markdown_path.write_text(render_markdown_report(report), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21a1cd2ea86163c3 — Filesystem access.
repo/src/utils/timeline_versioning.py:754 
        with open(out_path, "wb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #094fe2ffc00f6286 — Filesystem access.
repo/src/utils/timeline_xml.py:244 
    with open(path, "r", encoding="utf-8-sig") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #423d9270f44c3831 — Filesystem access.
repo/src/utils/timeline_xml.py:319 
    with open(path, "r", encoding="utf-8-sig") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #55294915057c7579 — Filesystem access.
repo/src/utils/timeline_xml.py:375 
    with open(out_path, "w", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ff9b4fa7dd29642d — Environment-variable access.
repo/src/utils/update_check.py:54 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af8e9a81c0b74c7e — Environment-variable access.
repo/src/utils/update_check.py:71 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #092e9f19829bd019 — Environment-variable access.
repo/src/utils/update_check.py:122 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7c6bb07596f829e4 — Environment-variable access.
repo/src/utils/update_check.py:170 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74984815afe90da5 — Environment-variable access.
repo/src/utils/update_check.py:246 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ba0a3551fbc47d99 — Environment-variable access.
repo/src/utils/update_check.py:288 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef17688d4042a8a3 — Environment-variable access.
repo/src/utils/update_check.py:380 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd1304eb5127099c — Environment-variable access.
repo/src/utils/update_check.py:498 
    values = os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #7e411650353e2381 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/utils/update_check.py:526 
        with urllib.request.urlopen(request, timeout=timeout) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

</> Dependencies

pyaaf2

python dependency
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #65bfc19b992e0b66 — Filesystem access.
pkgs/python/[email protected]/setup.py:33 
        with open(source_file, 'r') as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eee6ff7a32fdec27 — Filesystem access.
pkgs/python/[email protected]/setup.py:37 
        with open(target_file, 'w') as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b54ffd5373eedeee — Filesystem access.
pkgs/python/[email protected]/src/aaf2/ama.py:45 
    with open(path, 'rb') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c30bf5c3b5090eb — Filesystem access.
pkgs/python/[email protected]/src/aaf2/ama.py:73 
    with open(path, 'rb') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #006b73b5726c17c4 — Filesystem access.
pkgs/python/[email protected]/src/aaf2/file.py:202 
            self.f = io.open(path, mode, buffering=buffering)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #931305a525001f0d — Filesystem access.
pkgs/python/[email protected]/src/aaf2/mobs.py:320 
        with io.open(path, 'rb', buffering=io.DEFAULT_BUFFER_SIZE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8de62429a7435aa — Filesystem access.
pkgs/python/[email protected]/src/aaf2/mobs.py:363 
        with io.open(path, 'rb', buffering=io.DEFAULT_BUFFER_SIZE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3220cbe87942c64b — Filesystem access.
pkgs/python/[email protected]/src/aaf2/mxf.py:871 
        with io.open(path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • drp-format prod — registry 404