Close Open Privacy Scan
App Privacy Score
Medium risk · 1984 finding(s)
Based on: 4 first-party package(s) · 107/112 deps analyzed
Dependency score: 26 (High risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz Application data flows
No application data flows were found. See dependency data flows below.
hub Dependency data flows (1)
- 1source
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:520 - 2sink
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:523
</> First-Party Code
first-party (python)
go first-party err := sentry.Init(sentry.ClientOptions{
// Setup related config
Dsn: appState.ServerConfig.Config.Sentry.DSN,
Debug: appState.ServerConfig.Config.Sentry.Debug,
Release: "weaviate-core@" + build.Version,
Environment: appState.ServerConfig.Config.Sentry.Environment,
// Enable tracing if requested
EnableTracing: !appState.ServerConfig.Config.Sentry.TracingDisabled,
AttachStacktrace: true,
// Sample rates based on the config
SampleRate: appState.ServerConfig.Config.Sentry.ErrorSampleRate,
ProfilesSampleRate: appState.ServerConfig.Config.Sentry.ProfileSampleRate,
TracesSampler: sentry.TracesSampler(func(ctx sentry.SamplingContext) float64 {
// Inherit decision from parent transaction (if any) if it is sampled or not
if ctx.Parent != nil && ctx.Parent.Sampled != sentry.SampledUndefined {
return 1.0
}
// Filter out uneeded traces
switch ctx.Span.Name {
// We are not interested in traces related to metrics endpoint
case "GET /metrics":
// These are some usual internet bot that will spam the server. Won't catch them all but we can reduce
// the number a bit
case "GET /favicon.ico":
case "GET /t4":
case "GET /ab2g":
case "PRI *":
case "GET /api/sonicos/tfa":
case "GET /RDWeb/Pages/en-US/login.aspx":
case "GET /_profiler/phpinfo":
case "POST /wsman":
case "POST /dns-query":
case "GET /dns-query":
return 0.0
}
// Filter out graphql queries, currently we have no context intrumentation around it and it's therefore
// just a blank line with 0 info except graphql resolve -> do -> return.
if ctx.Span.Name == "POST /v1/graphql" {
return 0.0
}
// Return the configured sample rate otherwise
return appState.ServerConfig.Config.Sentry.TracesSampleRate
}),
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(fmt.Errorf("collection %q shard %q: %w",
s.index.Config.ClassName, s.name, err))
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(fmt.Errorf("collection %q shard %q: %w",
s.index.Config.ClassName, s.name, err))
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
libsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 554 low-confidence finding(s)
low env_fs — Environment-variable access. 396 locations
low env_fs — Filesystem access. 158 locations
</> Dependencies
github.com/getsentry/sentry-go
go dependency err := sentry.Init(sentry.ClientOptions{
// Either set your DSN here or set the SENTRY_DSN environment variable.
Dsn: "",
// Enable printing of SDK debug messages.
// Useful when getting started or trying to figure something out.
Debug: true,
Release: release,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "",
Debug: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "",
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
if hint.Context != nil {
if req, ok := hint.Context.Value(sentry.RequestContextKey).(*http.Request); ok {
// You have access to the original Request
fmt.Println(req)
}
}
fmt.Println(event)
return event
},
Debug: true,
AttachStacktrace: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "",
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
if hint.Context != nil {
if ctx, ok := hint.Context.Value(sentry.RequestContextKey).(*fasthttp.RequestCtx); ok {
// You have access to the original Context if it panicked
fmt.Println(string(ctx.Request.Host()))
}
}
fmt.Println(event)
return event
},
Debug: true,
AttachStacktrace: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Drop me!")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("say what again. SAY WHAT again")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureException(errors.New("say what again. SAY WHAT again"))
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureEvent(event)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureException(CustomComplexError{Message: "Captured", AnswerToLife: 42})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
if err := sentry.Init(sentry.ClientOptions{
Debug: true,
Dsn: "https://[email protected]/1337",
IgnoreErrors: []string{"^(?i)drop me"},
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
if ex, ok := hint.OriginalException.(CustomComplexError); ok {
event.Message = event.Message + " - " + ex.GimmeMoreData()
}
fmt.Printf("%s\n\n", prettyPrint(event))
return event
},
BeforeBreadcrumb: func(breadcrumb *sentry.Breadcrumb, _ *sentry.BreadcrumbHint) *sentry.Breadcrumb {
if breadcrumb.Message == "Random breadcrumb 3" {
breadcrumb.Message = "Not so random breadcrumb 3"
}
fmt.Printf("%s\n\n", prettyPrint(breadcrumb))
return breadcrumb
},
SampleRate: 1,
Transport: &devNullTransport{},
Integrations: func(integrations []sentry.Integration) []sentry.Integration {
return append(integrations, integrations[1])
},
}); err != nil {
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "",
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
if hint.Context != nil {
if ctx, ok := hint.Context.Value(sentry.RequestContextKey).(*fiber.Ctx); ok {
// You have access to the original Context if it panicked
fmt.Println(utils.CopyString(ctx.Hostname()))
}
}
fmt.Println(event)
return event
},
Debug: true,
AttachStacktrace: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "https://[email protected]/1337",
Debug: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #1")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #2")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #3")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #4")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #5")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "",
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
if hint.Context != nil {
if req, ok := hint.Context.Value(sentry.RequestContextKey).(*http.Request); ok {
// You have access to the original Request
fmt.Println(req)
}
}
fmt.Println(event)
return event
},
Debug: true,
AttachStacktrace: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
err := sentry.Init(sentry.ClientOptions{
// Either set your DSN here or set the SENTRY_DSN environment variable.
Dsn: "",
// Enable printing of SDK debug messages.
// Useful when getting started or trying to figure something out.
Debug: true,
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
// Here you can inspect/modify non-transaction events (for example, errors) before they are sent.
// Returning nil drops the event.
log.Printf("BeforeSend event [%s]", event.EventID)
return event
},
BeforeSendTransaction: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
// Here you can inspect/modify transaction events before they are sent.
// Returning nil drops the event.
if strings.Contains(event.Message, "test-transaction") {
// Drop the transaction
return nil
}
event.Message += " [example]"
log.Printf("BeforeSendTransaction event [%s]", event.EventID)
return event
},
// Enable tracing
EnableTracing: true,
// Specify either a TracesSampleRate...
TracesSampleRate: 1.0,
// ... or a TracesSampler
TracesSampler: sentry.TracesSampler(func(ctx sentry.SamplingContext) float64 {
// Don't sample health checks.
if ctx.Span.Name == "GET /health" {
return 0.0
}
return 1.0
}),
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "",
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
if hint.Context != nil {
if req, ok := hint.Context.Value(sentry.RequestContextKey).(*http.Request); ok {
// You have access to the original Request
fmt.Println(req)
}
}
fmt.Println(event)
return event
},
Debug: true,
AttachStacktrace: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "",
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
if hint.Context != nil {
if req, ok := hint.Context.Value(sentry.RequestContextKey).(*http.Request); ok {
// You have access to the original Request
fmt.Println(req)
}
}
fmt.Println(event)
return event
},
Debug: true,
AttachStacktrace: true,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
err := sentry.Init(sentry.ClientOptions{
// Either set your DSN here or set the SENTRY_DSN environment variable.
Dsn: "",
// Enable printing of SDK debug messages.
// Useful when getting started or trying to figure something out.
Debug: true,
EnableTracing: true,
TracesSampleRate: 1.0,
ProfilesSampleRate: 1.0,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
err := sentry.Init(sentry.ClientOptions{
// Either set your DSN here or set the SENTRY_DSN environment variable.
Dsn: "",
// Enable printing of SDK debug messages.
// Useful when getting started or trying to figure something out.
Debug: true,
// This is an optional function with access to the event before it is
// sent to Sentry. The event can be mutated, or sending can be aborted
// by returning nil.
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event { return event },
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Debug: true,
Dsn: "https://[email protected]/1337",
AttachStacktrace: true,
BeforeSend: func(e *sentry.Event, h *sentry.EventHint) *sentry.Event {
fmt.Println(prettyPrint(e))
return e
},
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
err := sentry.Init(sentry.ClientOptions{
Dsn: "",
EnableTracing: false,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
_ = sentry.Init(sentry.ClientOptions{
Dsn: "https://[email protected]/1337",
Debug: true,
Transport: sentrySyncTransport,
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #1")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #2")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #3")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #4")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #5")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #6")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureMessage("Event #7")
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
if err := sentry.Init(sentry.ClientOptions{
Debug: true,
Dsn: "https://[email protected]/1337",
BeforeSend: func(event *sentry.Event, hint *sentry.EventHint) *sentry.Event {
// Solution 1 (use beforeSend, which will be applied to
// error events and is usually application specific):
if ex, ok := hint.OriginalException.(CustomComplexError); ok {
for key, val := range ex.GimmeMoreData() {
event.Extra[key] = val
}
}
fmt.Printf("%s\n\n", prettyPrint(event.Extra))
return event
},
Transport: &devNullTransport{},
// Solution 2 (use custom integration, which will be
// applied to all events, can be extracted as a
// separate utility, and reused across projects):
Integrations: func(integrations []sentry.Integration) []sentry.Integration {
return append(integrations, new(ExtractExtra))
},
}); err != nil {
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
sentry.CaptureException(errWithExtra)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 7 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
data, err := os.ReadFile(filename)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/weaviate/weaviate
go dependency err := sentry.Init(sentry.ClientOptions{
// Setup related config
Dsn: appState.ServerConfig.Config.Sentry.DSN,
Debug: appState.ServerConfig.Config.Sentry.Debug,
Release: "weaviate-core@" + build.Version,
Environment: appState.ServerConfig.Config.Sentry.Environment,
// Enable tracing if requested
EnableTracing: !appState.ServerConfig.Config.Sentry.TracingDisabled,
AttachStacktrace: true,
// Sample rates based on the config
SampleRate: appState.ServerConfig.Config.Sentry.ErrorSampleRate,
ProfilesSampleRate: appState.ServerConfig.Config.Sentry.ProfileSampleRate,
TracesSampler: sentry.TracesSampler(func(ctx sentry.SamplingContext) float64 {
// Inherit decision from parent transaction (if any) if it is sampled or not
if ctx.Parent != nil && ctx.Parent.Sampled != sentry.SampledUndefined {
return 1.0
}
// Filter out uneeded traces
switch ctx.Span.Name {
// We are not interested in traces related to metrics endpoint
case "GET /metrics":
// These are some usual internet bot that will spam the server. Won't catch them all but we can reduce
// the number a bit
case "GET /favicon.ico":
case "GET /t4":
case "GET /ab2g":
case "PRI *":
case "GET /api/sonicos/tfa":
case "GET /RDWeb/Pages/en-US/login.aspx":
case "GET /_profiler/phpinfo":
case "POST /wsman":
case "POST /dns-query":
case "GET /dns-query":
return 0.0
}
// Filter out graphql queries, currently we have no context intrumentation around it and it's therefore
// just a blank line with 0 info except graphql resolve -> do -> return.
if ctx.Span.Name == "POST /v1/graphql" {
return 0.0
}
// Return the configured sample rate otherwise
return appState.ServerConfig.Config.Sentry.TracesSampleRate
}),
})
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(fmt.Errorf("collection %q shard %q: %w",
s.index.Config.ClassName, s.name, err))
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
entsentry.CaptureException(fmt.Errorf("collection %q shard %q: %w",
s.index.Config.ClassName, s.name, err))
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
libsentry.CaptureException(err)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 476 low-confidence finding(s)
low env_fs — Environment-variable access. 368 locations
low env_fs — Filesystem access. 108 locations
github.com/armon/go-metrics
go dependency client, err := statsd.New(addr)
A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
google.golang.org/protobuf
go dependency fmt.Printf("executing: %v\n%s\n", strings.Join(cmd.Args, " "), out)
PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 22 low-confidence finding(s)
low env_fs — Filesystem access. 16 locations
low env_fs — Environment-variable access. 6 locations
cloud.google.com/go/compute/metadata
go dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
b, _ := os.ReadFile("/sys/class/dmi/id/product_name")
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
cloud.google.com/go/storage
go dependencyexpand_more 11 low-confidence finding(s)
low env_fs — Environment-variable access. 10 locations
f, fErr := os.Create(filePath)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/Azure/azure-sdk-for-go/sdk/azcore
go dependencyexpand_more 1 low-confidence finding(s)
operatingSystem = os.Getenv("OS") // Get more specific OS information
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob
go dependencyexpand_more 1 low-confidence finding(s)
env, ok := os.LookupEnv(name)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/KimMachineGun/automemlimit
go dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 5 locations
low env_fs — Environment-variable access. 4 locations
github.com/aws/aws-sdk-go-v2
go dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 6 locations
github.com/aws/aws-sdk-go-v2/config
go dependencyexpand_more 37 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 33 locations
github.com/aws/aws-sdk-go-v2/credentials
go dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Filesystem access. 5 locations
cmd.Env = os.Environ()
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/aws/aws-sdk-go-v2/service/bedrockruntime
go dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
github.com/aws/aws-sdk-go-v2/service/s3
go dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
github.com/aws/aws-sdk-go-v2/service/sagemakerruntime
go dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
github.com/bmatcuk/doublestar
go dependencyexpand_more 1 low-confidence finding(s)
func (standardOS) Open(name string) (*os.File, error) { return os.Open(name) }
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/casbin/casbin/v2
go dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Filesystem access. 5 locations
github.com/cespare/xxhash/v2
go dependencyexpand_more 1 low-confidence finding(s)
f, err := os.Open(path)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/coreos/go-oidc/v3
go dependencyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
github.com/docker/docker
go dependencyexpand_more 314 low-confidence finding(s)
low env_fs — Environment-variable access. 96 locations
low env_fs — Filesystem access. 218 locations
github.com/docker/go-connections
go dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
low env_fs — Filesystem access. 6 locations
github.com/felixge/httpsnoop
go dependencyexpand_more 1 low-confidence finding(s)
} else if err := ioutil.WriteFile(name, src, 0644); err != nil {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/go-ego/gse
go dependencyexpand_more 7 low-confidence finding(s)
low env_fs — Filesystem access. 7 locations
github.com/go-jose/go-jose/v4
go dependencyexpand_more 4 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
github.com/go-openapi/runtime
go dependencyexpand_more 3 low-confidence finding(s)
caCert, err := os.ReadFile(opts.CA)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 2 locations
github.com/go-openapi/spec
go dependencyexpand_more 1 low-confidence finding(s)
var Debug = os.Getenv("SWAGGER_DEBUG") != "" //nolint:gochecknoglobals // public toggle for debug logging
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/go-openapi/swag
go dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
github.com/go-openapi/validate
go dependencyexpand_more 1 low-confidence finding(s)
Debug = os.Getenv("SWAGGER_DEBUG") != ""
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/golang-jwt/jwt/v4
go dependencyexpand_more 1 low-confidence finding(s)
if f, err := os.Open(p); err == nil {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/golang-jwt/jwt/v5
go dependencyexpand_more 1 low-confidence finding(s)
f, err := os.Open(p)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/gomlx/go-huggingface
go dependencyexpand_more 7 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 3 locations
github.com/googleapis/gax-go/v2
go dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
github.com/hashicorp/raft
go dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Filesystem access. 8 locations
github.com/ikawaha/kagome-dict
go dependencyexpand_more 4 low-confidence finding(s)
github.com/jessevdk/go-flags
go dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low env_fs — Environment-variable access. 3 locations
github.com/launchdarkly/go-server-sdk/v7
go dependencyexpand_more 4 low-confidence finding(s)
if os.Getenv("HTTP_PROXY") != "" {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/mark3labs/mcp-go
go dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
req, err := http.NewRequestWithContext(ctx, "GET", "https://httpbin.org/anything", nil)
Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low pii_flow — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime. 2 locations
github.com/maypok86/otter/v2
go dependencyexpand_more 4 low-confidence finding(s)
github.com/minio/minio-go/v7
go dependencyexpand_more 72 low-confidence finding(s)
low env_fs — Filesystem access. 20 locations
low env_fs — Environment-variable access. 52 locations
github.com/nyaruka/phonenumbers
go dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
github.com/parquet-go/parquet-go
go dependencyexpand_more 3 low-confidence finding(s)
for arg := range strings.SplitSeq(os.Getenv("PARQUETGODEBUG"), ",") {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Filesystem access. 2 locations
github.com/prometheus/client_golang
go dependencyexpand_more 3 low-confidence finding(s)
github.com/prometheus/common
go dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Filesystem access. 6 locations
github.com/sirupsen/logrus
go dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
github.com/spf13/cobra
go dependencyexpand_more 16 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
low env_fs — Filesystem access. 10 locations
github.com/tailor-platform/graphql
go dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
github.com/testcontainers/testcontainers-go
go dependencyexpand_more 19 low-confidence finding(s)
low env_fs — Filesystem access. 6 locations
low env_fs — Environment-variable access. 13 locations
github.com/urfave/cli/v2
go dependencyexpand_more 7 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
low env_fs — Environment-variable access. 4 locations
github.com/weaviate/contextionary
go dependencyexpand_more 13 low-confidence finding(s)
low env_fs — Filesystem access. 8 locations
low env_fs — Environment-variable access. 5 locations
github.com/weaviate/s5cmd/v2
go dependencyexpand_more 7 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
low env_fs — Filesystem access. 3 locations
github.com/weaviate/tiktoken-go
go dependencyexpand_more 7 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
low env_fs — Environment-variable access. 4 locations
github.com/weaviate/weaviate-go-client/v5
go dependencyexpand_more 2 low-confidence finding(s)
go.etcd.io/bbolt
go dependencyexpand_more 15 low-confidence finding(s)
low env_fs — Filesystem access. 12 locations
low env_fs — Environment-variable access. 3 locations
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
go dependencyexpand_more 1 low-confidence finding(s)
vRaw := os.Getenv(key)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
go dependencyexpand_more 1 low-confidence finding(s)
vRaw := os.Getenv(key)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
go.opentelemetry.io/otel/sdk
go dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Environment-variable access. 7 locations
low env_fs — Filesystem access. 3 locations
go.opentelemetry.io/otel/trace
go dependencyexpand_more 1 low-confidence finding(s)
strV := os.Getenv(key)
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
go.uber.org/automaxprocs
go dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
if max, exists := os.LookupEnv(_maxProcsKey); exists {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
golang.org/x/net
go dependencyexpand_more 28 low-confidence finding(s)
low env_fs — Filesystem access. 18 locations
low env_fs — Environment-variable access. 9 locations
res, err := http.Get(gitCommitURL)
Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
golang.org/x/oauth2
go dependencyexpand_more 12 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
low env_fs — Filesystem access. 6 locations
golang.org/x/sys
go dependencyexpand_more 59 low-confidence finding(s)
low env_fs — Environment-variable access. 28 locations
low env_fs — Filesystem access. 31 locations
golang.org/x/text
go dependencyexpand_more 31 low-confidence finding(s)
low env_fs — Filesystem access. 24 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 4 locations
low env_fs — Environment-variable access. 3 locations
gonum.org/v1/gonum
go dependencyexpand_more 13 low-confidence finding(s)
gopath = os.Getenv("GOPATH")
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Filesystem access. 12 locations
google.golang.org/grpc
go dependencyexpand_more 50 low-confidence finding(s)
low env_fs — Filesystem access. 35 locations
low env_fs — Environment-variable access. 15 locations
Skipped dependencies
Production
- github.com/danaugrs/go-tsne prod — module zip exceeds byte cap
- github.com/ikawaha/kagome-dict-ko prod — module zip exceeds byte cap
- github.com/ikawaha/kagome/v2 prod — module zip exceeds byte cap
- github.com/klauspost/compress prod — module zip exceeds byte cap
- google.golang.org/api prod — module zip exceeds byte cap