Close Open Privacy Scan

link https://github.com/TabbyML/tabby
bolt Snapshot: commit 21b2904
science engine v3
schedule 2026-07-09T10:09:26.290692+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 18 finding(s)

Dependency score: 100 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 18 low
First-party packages: 2
Dependency packages: 0
Ecosystem: java

swap_horiz Application data flows

No high- or medium-confidence application data-flow findings in this scan.

</> First-Party Code

first-party (npm)

java first-party
expand_more 9 low-confidence finding(s)
low env_fs production #1ab3f70fe316aa91 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Logger.java:7 
	private static String TABBY4ECLIPSE_LOG_DEBUG = System.getenv("TABBY4ECLIPSE_LOG_DEBUG");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32103ee1aad0c337 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Utils.java:5 
		return System.getProperty("os.name").toLowerCase().contains("win");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #325893a0d46ae69f — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:12 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f1766b5c885763dc — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:17 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2 = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #661a5ef07ca6aba7 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:12 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #977764d6d323cc49 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:17 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #05fe92a520bb86d0 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:22 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65f0f1e26630a6cf — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:38 
				String nodePath = nodePathFromPreference.replaceFirst("~", System.getProperty("user.home"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c3b444423b6f9f38 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:49 
				String systemPath = System.getenv("PATH");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (npm): clients/eclipse

java first-party
expand_more 9 low-confidence finding(s)
low env_fs production #1ab3f70fe316aa91 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Logger.java:7 
	private static String TABBY4ECLIPSE_LOG_DEBUG = System.getenv("TABBY4ECLIPSE_LOG_DEBUG");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32103ee1aad0c337 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Utils.java:5 
		return System.getProperty("os.name").toLowerCase().contains("win");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #325893a0d46ae69f — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:12 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f1766b5c885763dc — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:17 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2 = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #661a5ef07ca6aba7 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:12 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #977764d6d323cc49 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:17 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #05fe92a520bb86d0 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:22 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65f0f1e26630a6cf — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:38 
				String nodePath = nodePathFromPreference.replaceFirst("~", System.getProperty("user.home"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c3b444423b6f9f38 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:49 
				String systemPath = System.getenv("PATH");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @codemirror/language prod — dist-only: no readable source
  • @codemirror/search prod — dist-only: no readable source
  • @codemirror/state prod — dist-only: no readable source
  • @codemirror/theme-one-dark prod — dist-only: no readable source
  • @codemirror/view prod — dist-only: no readable source
  • @curvenote/ansi-to-react prod — dist-only: no readable source
  • @radix-ui/react-accordion prod — dist-only: no readable source
  • @radix-ui/react-avatar prod — dist-only: no readable source
  • @radix-ui/react-checkbox prod — dist-only: no readable source
  • @radix-ui/react-collapsible prod — dist-only: no readable source
  • @radix-ui/react-dropdown-menu prod — dist-only: no readable source
  • @radix-ui/react-dialog prod — dist-only: no readable source
  • @radix-ui/react-hover-card prod — dist-only: no readable source
  • @radix-ui/react-label prod — dist-only: no readable source
  • @radix-ui/react-popover prod — dist-only: no readable source
  • @radix-ui/react-radio-group prod — dist-only: no readable source
  • @radix-ui/react-scroll-area prod — dist-only: no readable source
  • @radix-ui/react-select prod — dist-only: no readable source
  • @radix-ui/react-separator prod — dist-only: no readable source
  • @radix-ui/react-slot prod — dist-only: no readable source
  • @radix-ui/react-switch prod — dist-only: no readable source
  • @radix-ui/react-tabs prod — dist-only: no readable source
  • @radix-ui/react-toggle prod — dist-only: no readable source
  • @radix-ui/react-tooltip prod — dist-only: no readable source
  • @urql/core prod — dist-only: no readable source
  • @urql/exchange-auth prod — dist-only: no readable source
  • @urql/exchange-graphcache prod — dist-only: no readable source
  • @vercel/kv prod — dist-only: no readable source
  • @vercel/og prod — dist-only: no readable source
  • class-variance-authority prod — dist-only: no readable source
  • cmdk prod — dist-only: no readable source
  • copy-to-clipboard prod — dist-only: no readable source
  • framer-motion prod — dist-only: no readable source
  • hast prod — no javascript source
  • mdast prod — no javascript source
  • next-themes prod — dist-only: no readable source
  • next prod — tarball exceeds byte cap
  • react-error-boundary prod — dist-only: no readable source
  • react-hook-form prod — dist-only: no readable source
  • react-lazy-load prod — dist-only: no readable source
  • react-nice-avatar prod — dist-only: no readable source
  • react-resizable-panels prod — dist-only: no readable source
  • react-textarea-autosize prod — dist-only: no readable source
  • sonner prod — dist-only: no readable source
  • swr prod — dist-only: no readable source
  • io.github.z4kn4fein:semver prod — no java source in jar