Close Open Privacy Scan
App Privacy Score
82
/100
Low privacy risk
Low risk · 3067 finding(s)
Based on: 1 first-party package(s) · 32/41 deps analyzed
Dependency score: 57 (Medium risk)
bar_chart Score Breakdown
egress
−15
env_fs
−3
list Scan Summary
0 high
2 medium
3065 low
First-party packages:
1
Dependency packages:
29
Ecosystem:
python
swap_horiz Application data flows
No application data flows were found. See dependency data flows below.
hub Dependency data flows (1)
medium
transformers
dependency
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
- 1source
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 - 2sink
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
</> First-Party Code
first-party (python)
python first-partyexpand_more 230 low-confidence finding(s)
low env_fs — Environment-variable access. 126 locations
low env_fs — Filesystem access. 102 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
</> Dependencies
modelscope
python dependency
medium
telemetry
dependency
Excluded from app score
#e185031edf844fac
capability detected · no path traced
—
Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/modelscope/pipelines/cv/video_single_object_tracking_pipeline.py:82
out = self.tracker.track(frame)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 737 low-confidence finding(s)
low env_fs — Filesystem access. 502 locations
pkgs/python/[email protected]/modelscope/models/cv/image_mvs_depth_estimation_geomvsnet/utils.py:101
pkgs/python/[email protected]/modelscope/models/cv/image_to_3d/ldm/modules/encoders/clip/clip.py:164
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:112
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:141
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:175
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:189
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:207
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:244
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:296
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:317
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:339
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:370
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:412
pkgs/python/[email protected]/modelscope/models/cv/nerf_recon_acc/dataloader/read_write_model.py:429
pkgs/python/[email protected]/modelscope/models/cv/object_detection/mmdet_ms/utils/checkpoint.py:550
pkgs/python/[email protected]/modelscope/models/cv/object_detection/mmdet_ms/utils/checkpoint.py:557
pkgs/python/[email protected]/modelscope/ops/image_control_3d_portrait/torch_utils/custom_ops.py:125
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 29 locations
low env_fs — Environment-variable access. 206 locations
pkgs/python/[email protected]/modelscope/models/cv/object_detection/mmdet_ms/utils/checkpoint.py:116
pkgs/python/[email protected]/modelscope/models/cv/object_detection/mmdet_ms/utils/checkpoint.py:139
pkgs/python/[email protected]/modelscope/models/multi_modal/videocomposer/videocomposer_model.py:100
pkgs/python/[email protected]/modelscope/models/multi_modal/videocomposer/videocomposer_model.py:101
transformers
python dependency
medium
pii_flow
dependency
Excluded from app score
#313d1cb5f5c515d2
—
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
· flow /tmp/closeopen-hbkx2csl/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 → /tmp/closeopen-hbkx2csl/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
logger.debug(f"[Kubeflow] Token file not found: {token_path}")PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 399 low-confidence finding(s)
low env_fs — Filesystem access. 249 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 13 locations
low env_fs — Environment-variable access. 136 locations
low
egress
dependency
Excluded from app score
#7debab390f899d7e
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/transformers/utils/attention_visualizer.py:183
img = Image.open(io.BytesIO(httpx.get(img, follow_redirects=True).content))Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
PyYAML
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
ToJyutping
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
av
python dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
low
egress
dependency
Excluded from app score
#4bc412120e0b7872
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/av/datasets.py:76
response = urlopen(url)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
chardet
python dependencyexpand_more 38 low-confidence finding(s)
low env_fs — Filesystem access. 32 locations
low env_fs — Environment-variable access. 6 locations
cn2an
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
fast_langdetect
python dependencyexpand_more 1 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#f3f8da419995ec5f
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/src/fast_langdetect/infer.py:22
CACHE_DIRECTORY = os.getenv("FTLANG_CACHE", str(DEFAULT_CACHE_DIR))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fastapi
python dependencyexpand_more 70 low-confidence finding(s)
low env_fs — Filesystem access. 55 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 12 locations
low
env_fs
tooling
Excluded from app score
unreachable
#7bbb33a782cb9082
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/scripts/docs.py:129
os.environ["DYLD_FALLBACK_LIBRARY_PATH"] = "/opt/homebrew/lib"Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
funasr
python dependencyexpand_more 127 low-confidence finding(s)
low env_fs — Filesystem access. 101 locations
low env_fs — Environment-variable access. 17 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 9 locations
g2p_en
python dependencyexpand_more 1 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#7d59cc3e4b42c870
capability detected · no path traced
—
Filesystem access.
pkgs/python/[email protected]/setup.py:9
with open(path.join(here, 'README.rst'), encoding='utf-8') as f:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
jieba
python dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Filesystem access. 8 locations
jieba_fast
python dependencyexpand_more 7 low-confidence finding(s)
low env_fs — Filesystem access. 7 locations
librosa
python dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
low env_fs — Filesystem access. 2 locations
numba
python dependencyexpand_more 74 low-confidence finding(s)
low env_fs — Filesystem access. 47 locations
low env_fs — Environment-variable access. 27 locations
numpy
python dependencyexpand_more 982 low-confidence finding(s)
low env_fs — Filesystem access. 618 locations
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57
low env_fs — Environment-variable access. 356 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 3 locations
opencc
python dependencyexpand_more 68 low-confidence finding(s)
low env_fs — Filesystem access. 57 locations
low env_fs — Environment-variable access. 11 locations
peft
python dependencyexpand_more 12 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 8 locations
psutil
python dependencyexpand_more 28 low-confidence finding(s)
low env_fs — Filesystem access. 19 locations
low env_fs — Environment-variable access. 7 locations
low
egress
tooling
Excluded from app score
unreachable
#ccec1e10b0567e5f
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:194
res = requests.get(url, timeout=REQUEST_TIMEOUT)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low
egress
tooling
Excluded from app score
unreachable
#382602b24d3340d5
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/install_pip.py:34
req = urlopen(URL, **kwargs)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
pydantic
python dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 5 locations
pyopenjtalk
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
low
egress
dependency
Excluded from app score
#1dd9433e3e1819a7
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/pyopenjtalk/__init__.py:60
with urlopen(_DICT_URL) as response:Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
pypinyin
python dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
python_mecab_ko
python dependencyexpand_more 1 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#0a57dcdc95f346c8
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/setup.py:39
paths.append(os.environ["PATH"])Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pytorch-lightning
python dependencyexpand_more 187 low-confidence finding(s)
low env_fs — Filesystem access. 24 locations
low env_fs — Environment-variable access. 160 locations
low
egress
tooling
reachable
#d398a856e7246108
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/pytorch_lightning/demos/transformer.py:150
f.write(requests.get(url).text)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
sentencepiece
python dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Filesystem access. 9 locations
low
env_fs
dependency
Excluded from app score
#d25a8f781170389b
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/setup.py:276
if os.getenv('PYTHON_ARCH', '') == 'ARM64':Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
split-lang
python dependencyexpand_more 1 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#dbe1b509398530c4
capability detected · no path traced
—
Filesystem access.
pkgs/python/[email protected]/setup.py:11
with open(packagefile(*relpath), encoding="utf-8") as f:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
torchmetrics
python dependencyexpand_more 16 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
low env_fs — Filesystem access. 8 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
low
egress
dependency
Excluded from app score
#c2f08308f5a6df66
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/torchmetrics/functional/audio/nisqa.py:150
myfile = requests.get(url)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
tqdm
python dependencyexpand_more 20 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low env_fs — Environment-variable access. 5 locations
wordsegment
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
Skipped dependencies
Production
- scipy prod — sdist exceeds byte cap
- tensorboard prod — no sdist (wheels only)
- gradio prod — sdist exceeds byte cap
- onnxruntime prod — no sdist (wheels only)
- onnxruntime-gpu prod — no sdist (wheels only)
- torchaudio prod — no sdist (wheels only)
- g2pk2 prod — no sdist (wheels only)
- ko_pron prod — no sdist (wheels only)
- ctranslate2 prod — no sdist (wheels only)