Close Open Privacy Scan

bolt Snapshot: commit e940b6a

science engine v1.22

schedule 2026-07-23T09:15:08.376360+00:00

smart_toy MCP server detected: @ai-sdk/anthropic, @ai-sdk/openai, @anthropic-ai/sdk, @modelcontextprotocol/sdk +2 more — detected in dependencies, not a safety judgment.

App Privacy Score

100 /100

Low privacy risk

Low risk · 89 finding(s)

Dependency score: 72 (Medium risk)

bar_chart Score Breakdown

No category deductions recorded.

list Scan Summary

0 high 0 medium 89 low

First-party packages: 1

Dependency packages: 6

Ecosystem: rust

swap_horiz External domains

100.82.5.118agentskills.ioai-gateway.vercel.shai-sdk.devai.google.devaihubmix.comaiplatform.googleapis.comaistudio.google.comapexsurveys.oracle.comapi.aiapi.aihubmix.comapi.anthropic.comapi.asksage.aiapi.cerebras.aiapi.cline.botapi.deepseek.comapi.dify.aiapi.exa.aiapi.fireworks.aiapi.getdial.aiapi.github.comapi.groq.comapi.hicap.aiapi.inference.wandb.aiapi.kilo.aiapi.minimax.ioapi.mistral.aiapi.moonshot.aiapi.novu.coapi.openai.comapi.sambanova.aiapi.studio.nebius.aiapi.telegram.orgapi.together.aiapi.together.xyzapi.v0.devapi.workos.comapi.x.aiapi.xiaomimimo.comapi.z.aiapp.baseten.coapp.cline.botapp.example.botapp.posthog.comapp.requestly.ioark.cn-beijing.volces.comauth.openai.comauth.tokenfactory.nebius.comautopush-generativelanguage.sandbox.googleapis.comavatars.githubusercontent.combailian.console.aliyun.combase-ui.combedrock-agent-runtime.us-west-2.amazonaws.combedrock-mantle.us-east-1.api.awsbedrock-runtime.us-east-1.amazonaws.combitcoin.orgchatgpt.comclaude.aicline.botcline.github.iocloud.cerebras.aicloud.google.comcloud.langfuse.comcloud.tencent.comcode-internal.aiservice.us-chicago-1.oci.oraclecloud.comcode.aiservice.us-chicago-1.oci.oraclecloud.comcommunity.cline.botconfluence.oraclecorp.comconsole.aihubmix.comconsole.anthropic.comconsole.groq.comconsole.mistral.aiconsole.volcengine.comcore-api.staging.int.cline.botcursor.comcustomersurveys.oracle.comdashboard.hicap.aidashscope.aliyuncs.comdata.cline.botdevelopers.openai.comdiscord.comdiscord.ggdocs.anthropic.comdocs.cline.botdocs.cloud.google.comdocs.expo.devdocs.litellm.aidocs.sambanova.aidummy.comejiidnob33g9ap1r.public.blob.vercel-storage.comexample.ngrok-free.appfirebaseinstallations.googleapis.comfirebaselogging.googleapis.comfireworks.aifonts.googleapis.comgemini-api-demos.uc.r.appspot.comgenerativelanguage.googleapis.comgithub.comgoo.glgoogle.aip.devhelp.openai.comhelp.sap.comheroui-assets.nyc3.cdn.digitaloceanspaces.comheroui.comhuggingface.coidcs-9dc693e80d9b469480d7afe00e743931.identity.oraclecloud.comimg.heroui.chatinfer-modelarts.cn-southwest-2.myhuaweicloud.cominference-api.nousresearch.cominference.baseten.coinference.poolside.aiinvalid-url-to-show-fallback.comjs-na2.hs-scripts.comjson-schema.orglmstudio.ailogin-ext.identity.oraclecloud.commanagement.azure.commarketplace.visualstudio.commodel-api.baseten.comodelcontextprotocol.iomodels.devnews.google.comnpm.imoauth2.googleapis.comontheline.trincoll.eduopen.bigmodel.cnopenrouter.aiplatform.claude.complatform.moonshot.aiplatform.moonshot.cnplatform.openai.compokeapi.coposthog.compptr.devpurl.oclc.orgpurl.orgradix-ui.comraw.githubusercontent.comreact.devregistry.npmjs.orgrouter.huggingface.corouter.requesty.aischemas.microsoft.comschemas.openxmlformats.orgschemas.zwobble.orgscira.aisentry.ioskills.shstaging-app.cline.botstorage.googleapis.comsupport.huaweicloud.comswapi.py4e.comt3.chattokenhub.tencentmaas.comus.i.posthog.comus.posthog.comv0.appvercel.comvia.placeholder.comwandb.aiwww.allrecipes.comwww.anthropic.comwww.apple.comwww.baseten.cowww.deepseek.comwww.foodnetwork.comwww.google.comwww.googleapis.comwww.gstatic.comwww.linkedin.comwww.minimax.iowww.reddit.comwww.w3.orgx.aix.comz.ai

</> First-Party Code

first-party (rust): apps/examples/desktop-app/src-tauri

rust first-party

expand_more 4 low-confidence finding(s)

low env_fs test-only Excluded from app score #bdc919cfcebc56f6 — Environment-variable access.

repo/apps/examples/desktop-app/src-tauri/src/main.rs:313

    let explicit = std::env::var("CLINE_CODE_SIDECAR_BIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ec6d888f6359de57 — Environment-variable access.

repo/apps/examples/desktop-app/src-tauri/src/main.rs:491

    if let Ok(value) = std::env::var("CLINE_MCP_SETTINGS_PATH") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #09e97482c948760e — Environment-variable access.

repo/apps/examples/desktop-app/src-tauri/src/main.rs:497

    let home = std::env::var("HOME").map_err(|_| "HOME is not set".to_string())?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #e5388f3ab82ac08b — Filesystem access.

repo/apps/examples/desktop-app/src-tauri/src/main.rs:630

        fs::write(&settings_path, body)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

rfd

rust dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #628af579e01cc5eb — Environment-variable access.

pkgs/rust/[email protected]/build.rs:2

    let target_os = std::env::var("CARGO_CFG_TARGET_OS").expect("target OS not detected");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #caa1b4b523f31647 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:8

            let gtk = std::env::var_os("CARGO_FEATURE_GTK3").is_some();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb6ce9a6edb82a72 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:9

            let xdg = std::env::var_os("CARGO_FEATURE_XDG_PORTAL").is_some();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4024b2c4e54dfaa7 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:18

                let tokio = std::env::var_os("CARGO_FEATURE_TOKIO").is_some();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #defc6f5f51a93395 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:19

                let async_std = std::env::var_os("CARGO_FEATURE_ASYNC_STD").is_some();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #be7b02eda490d53a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/backend/macos/utils/user_alert.rs:183

            log::error!("UserAler result send error: {err}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #4794ca6e458d5597 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/backend/macos/utils/user_alert.rs:191

                log::error!("UserAler error: {err}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low env_fs dependency Excluded from app score #8fe7f2f944403af3 — Filesystem access.

pkgs/rust/[email protected]/src/file_handle/native.rs:29

                    let res = std::fs::read(path);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a10b8d56316686fc — Filesystem access.

pkgs/rust/[email protected]/src/file_handle/native.rs:82

                    let res = std::fs::write(path, bytes);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

serde

rust dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #2e971985fe8403c3 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:24

    let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be9cdbe56f03fa2b — Environment-variable access.

pkgs/rust/[email protected]/build.rs:25

    let patch_version = env::var("CARGO_PKG_VERSION_PATCH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #238a8908dd94c840 — Filesystem access.

pkgs/rust/[email protected]/build.rs:27

    fs::write(out_dir.join("private.rs"), module).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ff79433fe13e294 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:61

    let rustc = env::var_os("RUSTC")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

serde_json

rust dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #f547fc0b1700d7e4 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:10

    let target_arch = env::var_os("CARGO_CFG_TARGET_ARCH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b1dad81a1e5139b — Environment-variable access.

pkgs/rust/[email protected]/build.rs:11

    let target_pointer_width = env::var_os("CARGO_CFG_TARGET_POINTER_WIDTH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tauri

rust dependency

expand_more 42 low-confidence finding(s)

low env_fs dependency Excluded from app score #a0c227c79e6a99ae — Environment-variable access.

pkgs/rust/[email protected]/build.rs:241

  std::env::var(format!("CARGO_FEATURE_{}", AsShoutySnakeCase(feature)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5dae332ef3150308 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:263

  let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe25c7bfcd2c82f4 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:268

  let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3340a621d658690e — Filesystem access.

pkgs/rust/[email protected]/build.rs:271

  std::fs::write(
    checked_features_out_path,
    CHECKED_FEATURES.get().unwrap().lock().unwrap().join(","),
  )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95db2dc8e2558ac9 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:279

  let target_env = std::env::var("CARGO_CFG_TARGET_ENV");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0bc639a446ffb0f — Environment-variable access.

pkgs/rust/[email protected]/build.rs:280

  let is_tauri_workspace = std::env::var("__TAURI_WORKSPACE__").is_ok_and(|v| v == "true");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d9836ee1fd198a8 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:287

      std::env::var(var).unwrap_or_else(|_| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12f5f149a7ef150e — Environment-variable access.

pkgs/rust/[email protected]/build.rs:292

    if let Ok(kotlin_out_dir) = std::env::var("WRY_ANDROID_KOTLIN_FILES_OUT_DIR") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b413f940ca9c4bd — Filesystem access.

pkgs/rust/[email protected]/build.rs:311

        let content = fs::read_to_string(file.path())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa809e62a084cf4b — Environment-variable access.

pkgs/rust/[email protected]/build.rs:324

    if let Some(project_dir) = env::var_os("TAURI_ANDROID_PROJECT_PATH").map(PathBuf::from) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9af02c90f6c3a7df — Environment-variable access.

pkgs/rust/[email protected]/build.rs:325

      let package_unescaped = env::var("TAURI_ANDROID_PACKAGE_UNESCAPED")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eda11649a4794eb9 — Filesystem access.

pkgs/rust/[email protected]/build.rs:329

      std::fs::write(
        project_dir.join("app").join("proguard-tauri.pro"),
        tauri_proguard,
      )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8aef2f369e3d5101 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:337

      PathBuf::from(std::env::var_os("CARGO_MANIFEST_DIR").unwrap()).join("mobile/android");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7eac3bf3886b7718 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:345

        PathBuf::from(std::env::var_os("CARGO_MANIFEST_DIR").unwrap()).join("mobile/ios-api");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8b0ff1387192741 — Filesystem access.

pkgs/rust/[email protected]/src/app.rs:361

        return std::fs::read(asset_path).ok().map(|bytes| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #6cff8d26a161337b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/app.rs:576

      log::error!("failed to exit: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #325e366582facfcb — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/app.rs:590

      log::debug!("restart triggered on the main thread");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #14d056df1fa5701e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/app.rs:594

      log::debug!("restart triggered from a separate thread");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #5a2e8392329e0499 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/app.rs:606

          log::error!("failed to request exit: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low env_fs dependency Excluded from app score #e8aff26bb09c9989 — Filesystem access.

pkgs/rust/[email protected]/src/image/mod.rs:97

    let bytes = std::fs::read(path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #85562b0540efe6a7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/manager/mod.rs:74

            log::debug!("Unknown CspHash variant encountered: {:?}", _csp_hash);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #0993e7262666774b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/manager/mod.rs:409

        log::debug!("Asset `{path}` not found; fallback to {path}.html");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #7c07a94d2b964041 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/manager/mod.rs:416

        log::debug!("Asset `{path}` not found; fallback to {path}/index.html",);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #16d2f27f610fa6a8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/manager/mod.rs:423

        log::debug!("Asset `{path}` not found; fallback to index.html");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #b1e89e8b55b07c24 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/manager/mod.rs:431

        log::error!("{error}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #30d7569cbb4e0d9d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/path/android.rs:54

          log::error!("failed to get file name from URI: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #633b62250b2b04bc — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/process.rs:84

      log::error!("failed to restart app: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #01e75b1dc6187f9e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/process.rs:122

            log::error!("failed to restart app: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #91876a512bd32f3a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/asset.rs:42

    log::error!("asset protocol path \"{}\" is not valid: {}", path, e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #0ef2bf0d62f198de — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/asset.rs:47

    log::error!("asset protocol not configured to allow the path: {}", path);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low env_fs dependency Excluded from app score #b18437f5b77a26a2 — Filesystem access.

pkgs/rust/[email protected]/src/protocol/asset.rs:52

  let mut file = match File::open(path.clone()) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #6ddae57ccb68d045 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/asset.rs:58

          log::error!("Failed to open Android external storage file '{}': {}. This may be due to missing storage permissions.", path, e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #2378ea3d3aeeb559 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/asset.rs:62

        log::error!("File does not exist at path: {}", path);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #90ee2f53f47203d9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/asset.rs:65

        log::error!("Missing OS permission to access path \"{}\": {}", path, e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #186131b28425a4ca — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/tauri.rs:133

          log::info!("adding dev server root certificate");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #4eca07cc41fcb9db — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/tauri.rs:145

          log::warn!(
            "the dev root-certificate-path option was provided, but you must enable one of the following Tauri features in Cargo.toml: native-tls, native-tls-vendored, rustls-tls"
          );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #93293f54643f27e6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/tauri.rs:150

        log::warn!(
          "loading HTTPS URL; you might need to provide a certificate via the `dev --root-certificate-path` option. You must enable one of the following Tauri features in Cargo.toml: native-tls, native-tls-vendored, rustls-tls"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #99a5cd2a48ce9738 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/protocol/tauri.rs:206

        log::error!("{error_message}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #6b556b3d80d941f5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/webview/mod.rs:396

          tracing::error!("failed to resolve data directory");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #fae05ff6a08bce3c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/webview/mod.rs:403

              tracing::error!(
                "data_directory `{}` is not a safe path, ignoring config. Validation error was: {_err}",
                data_directory.display()
              );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #8170d860452cfa92 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/webview/mod.rs:416

              tracing::error!(
                "data_directory `{}` is not a relative path, ignoring config.",
                data_directory.display()
              );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #eab4260209d080d5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/webview/mod.rs:1750

      tracing::error!(
        "__TAURI_INVOKE_KEY__ expected {expected} but received {}",
        request.invoke_key
      );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

tauri-plugin-updater

rust dependency

expand_more 24 low-confidence finding(s)

low env_fs dependency Excluded from app score #266dbc0fa2dc23b4 — Environment-variable access.

pkgs/rust/[email protected]/build.rs:12

    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9794094e6bbd574d — Environment-variable access.

pkgs/rust/[email protected]/src/updater.rs:396

            if std::env::var_os("SSL_CERT_FILE").is_none() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71ba1b046e32f1b8 — Environment-variable access.

pkgs/rust/[email protected]/src/updater.rs:399

            if std::env::var_os("SSL_CERT_DIR").is_none() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #1a9d829e35279dbf — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:443

            log::debug!("checking for updates {url}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #7d8bb68e78278876 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:462

                log::debug!("disabling proxy");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #8eba746490aaeb87 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:465

                log::debug!("using proxy {proxy}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #9f323f2a7f27a61e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:486

                            log::debug!("update endpoint returned 204 No Content");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #027221474fd88c40 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:491

                        log::debug!("update response: {update_response:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #2aede2609e0e10c3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:497

                                log::debug!("parsed release response {release:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #2cdd497a5e0e67c6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:504

                                log::error!("failed to deserialize update response: {err}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #63b540a370bdfd39 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:509

                        log::error!(
                            "update endpoint did not respond with a successful status code"
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #589b641c26b7b733 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:515

                    log::error!("failed to check for updates: {err}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #bb5a4214d8bcc1b0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:589

            log::debug!("Searching for updater target '{target}' in release data");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #20290b8aade61376 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:838

            log::debug!("running on_before_exit hook");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low env_fs dependency Excluded from app score #5c71090a9935a5c1 — Environment-variable access.

pkgs/rust/[email protected]/src/updater.rs:844

            WindowsUpdaterType::Msi { .. } => std::env::var("SYSTEMROOT").as_ref().map_or_else(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #73d76e0e8ff5d237 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:1007

                        log::debug!("extracting AppImage");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #0522996b6401b591 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:1031

                    log::debug!("rewriting AppImage");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low env_fs dependency Excluded from app score #9c904a0f3e600df2 — Filesystem access.

pkgs/rust/[email protected]/src/updater.rs:1032

                    return match std::fs::write(&self.extract_path, bytes)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #2b3c19b02b54d721 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:1052

            log::warn!("update is not a valid deb package");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low env_fs dependency Excluded from app score #920616d524a19894 — Filesystem access.

pkgs/rust/[email protected]/src/updater.rs:1089

                    if std::fs::write(&pkg_path, bytes).is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low telemetry dependency Excluded from app score #03125393117bbd21 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:1120

                log::debug!("installed {pkg_path:?} with pkexec");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #b583090fa3d2a41f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:1128

                log::debug!("installed {pkg_path:?} with GUI sudo");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #ec7d6d2bff89ec2d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:1141

            log::debug!("installed {pkg_path:?} with sudo");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

low telemetry dependency Excluded from app score #9b66ac524ebd32b5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.

pkgs/rust/[email protected]/src/updater.rs:1271

            log::debug!("app installation needs admin privileges");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

tokio

rust dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #895265496678c355 — Filesystem access.

pkgs/rust/[email protected]/src/fs/read.rs:76

    asyncify(move || std::fs::read(path)).await

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d68a291355cd1ee3 — Filesystem access.

pkgs/rust/[email protected]/src/fs/read_to_string.rs:29

    asyncify(move || std::fs::read_to_string(path)).await

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4cc247cb5c7f8df3 — Filesystem access.

pkgs/rust/[email protected]/src/fs/write.rs:95

    asyncify(move || std::fs::write(path, contents)).await

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4958e600cea4b28f — Environment-variable access.

pkgs/rust/[email protected]/src/loom/std/mod.rs:90

        match std::env::var(ENV_WORKER_THREADS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

@cline/shared prod — dist-only: no readable source
@cline/llms prod — dist-only: no readable source
@cline/agents prod — dist-only: no readable source
@cline/core prod — dist-only: no readable source
@types/uuid prod — no javascript source
@chat-adapter/discord prod — dist-only: no readable source
@chat-adapter/gchat prod — dist-only: no readable source
@chat-adapter/linear prod — dist-only: no readable source
@chat-adapter/slack prod — dist-only: no readable source
@chat-adapter/telegram prod — dist-only: no readable source
@chat-adapter/whatsapp prod — dist-only: no readable source
@clack/prompts prod — dist-only: no readable source
@cline/cline-hub prod — registry 404
class-variance-authority prod — dist-only: no readable source
framer-motion prod — dist-only: no readable source
fuse.js prod — dist-only: no readable source
magic-string prod — dist-only: no readable source
mermaid prod — dist-only: no readable source
react-textarea-autosize prod — dist-only: no readable source
react-virtuoso prod — dist-only: no readable source
@radix-ui/react-use-controllable-state prod — dist-only: no readable source
@rive-app/react-webgl2 prod — dist-only: no readable source
@shikijs/langs prod — dist-only: no readable source
@shikijs/themes prod — dist-only: no readable source
@streamdown/cjk prod — dist-only: no readable source
@xyflow/react prod — dist-only: no readable source
cmdk prod — dist-only: no readable source
motion prod — dist-only: no readable source
next-themes prod — dist-only: no readable source
react-jsx-parser prod — dist-only: no readable source
shadcn prod — dist-only: no readable source
shiki prod — dist-only: no readable source
sonner prod — dist-only: no readable source
streamdown prod — dist-only: no readable source
tokenlens prod — dist-only: no readable source
use-stick-to-bottom prod — dist-only: no readable source
@cline/sdk prod — dist-only: no readable source
@radix-ui/react-accordion prod — dist-only: no readable source
@radix-ui/react-aspect-ratio prod — dist-only: no readable source

verified_user No application data leak found

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz External domains

</> First-Party Code

first-party (rust): apps/examples/desktop-app/src-tauri

</> Dependencies

rfd

serde

serde_json

tauri

tauri-plugin-updater

tokio

Skipped dependencies