Close Open Privacy Scan
App Privacy Score
—
/100
Not analyzed — coverage too low
Coverage too low to score · 1892 finding(s)
Based on: 80 first-party package(s) · 97/288 deps analyzed
bar_chart Score Breakdown
telemetry
−25
egress
−5
env_fs
−3
list Scan Summary
0 high
0 medium
1892 low
First-party packages:
28
Dependency packages:
3
Ecosystem:
rust
swap_horiz Application data flows
Not enough of this repository was analyzed to look for application data flows. Absence of findings here is not evidence of a clean result.
</> First-Party Code
first-party (rust): rust/agent
rust first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#6dc70d477909d5c8
capability detected · no path traced
—
Environment-variable access.
repo/rust/agent/src/inference/anthropic.rs:168
let api_key = std::env::var("ANTHROPIC_API_KEY")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (rust): rust/benchmark
rust first-partyexpand_more 15 low-confidence finding(s)
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 6 locations
low env_fs — Filesystem access. 9 locations
first-party (rust): rust/blockstore
rust first-partyexpand_more 26 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 24 locations
first-party (rust): rust/cache
rust first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low
env_fs
production
#96004e220a597986
capability detected · no path traced
—
Filesystem access.
repo/rust/cache/src/foyer.rs:755
File::create(path.as_path())Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (rust): rust/chroma
rust first-partyexpand_more 12 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 2 locations
low env_fs — Environment-variable access. 10 locations
first-party (rust): rust/cli
rust first-partyexpand_more 13 low-confidence finding(s)
low env_fs — Filesystem access. 12 locations
low
egress
production
#e11a57b782e37c45
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
repo/rust/cli/src/commands/update.rs:34
let releases = client
.get(GITHUB_RELEASES_URL)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
first-party (rust): rust/faults
rust first-partyexpand_more 2 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 2 locations
first-party (rust): rust/foundation-api
rust first-partyexpand_more 25 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 3 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 19 locations
first-party (rust): rust/frontend
rust first-partyexpand_more 61 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 60 locations
low
env_fs
production
#5e69c9e415a1ffc6
capability detected · no path traced
—
Environment-variable access.
repo/rust/frontend/src/lib.rs:52
let config = match std::env::var(CONFIG_PATH_ENV_VAR) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (rust): rust/frontend-core
rust first-partyexpand_more 5 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 5 locations
first-party (rust): rust/garbage_collector
rust first-partyexpand_more 178 low-confidence finding(s)
low env_fs — Filesystem access. 8 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 166 locations
first-party (rust): rust/index
rust first-partyexpand_more 168 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 168 locations
first-party (rust): rust/log
rust first-partyexpand_more 6 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 6 locations
first-party (rust): rust/log-service
rust first-partyexpand_more 56 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 55 locations
low
env_fs
production
#b930451c4621b4ab
capability detected · no path traced
—
Environment-variable access.
repo/rust/log-service/src/lib.rs:4362
let config = match std::env::var(CONFIG_PATH_ENV_VAR) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (rust): rust/mdac
rust first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#4a40b8cc075070f9
capability detected · no path traced
—
Filesystem access.
repo/rust/mdac/src/scorecard.rs:151
let rules = std::fs::read_to_string(path)?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (rust): rust/memberlist
rust first-partyexpand_more 8 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 8 locations
first-party (rust): rust/metering
rust first-partyexpand_more 2 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 2 locations
first-party (rust): rust/rust-sysdb
rust first-partyexpand_more 58 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 57 locations
low
env_fs
production
#68d9f7a00b3d9924
capability detected · no path traced
—
Environment-variable access.
repo/rust/rust-sysdb/src/lib.rs:16
let config = match std::env::var(CONFIG_PATH_ENV_VAR) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (rust): rust/s3heap-service
rust first-partyexpand_more 4 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 4 locations
first-party (rust): rust/segment
rust first-partyexpand_more 75 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 74 locations
low
env_fs
production
#0e34917d76291b0f
capability detected · no path traced
—
Filesystem access.
repo/rust/segment/src/local_hnsw.rs:876
let mut file = std::fs::File::create(metadata_file_path)?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (rust): rust/spanner-migrations
rust first-partyexpand_more 34 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 31 locations
low
env_fs
production
#07a0aeaad3b6b912
capability detected · no path traced
—
Environment-variable access.
repo/rust/spanner-migrations/src/config.rs:68
env::var(CONFIG_PATH_ENV_VAR).unwrap_or_else(|_| DEFAULT_CONFIG_PATH.to_string());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Filesystem access. 2 locations
first-party (rust): rust/storage
rust first-partyexpand_more 33 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 27 locations
low env_fs — Environment-variable access. 2 locations
low env_fs — Filesystem access. 4 locations
first-party (rust): rust/sysdb
rust first-partyexpand_more 21 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 21 locations
first-party (rust): rust/system
rust first-partyexpand_more 28 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 24 locations
low env_fs — Filesystem access. 2 locations
low env_fs — Environment-variable access. 2 locations
first-party (rust): rust/tracing
rust first-partyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 4 locations
first-party (rust): rust/types
rust first-partyexpand_more 5 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
low env_fs — Filesystem access. 2 locations
low
telemetry
production
#1350a964964d0783
capability detected · no path traced
—
Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/types/src/sparse_posting_block.rs:868
tracing::error!(
part = i,
"count stamp on non-initial directory part; ignoring it"
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
first-party (rust): rust/wal3
rust first-partyexpand_more 57 low-confidence finding(s)
low
env_fs
production
#5049f40eb8833ad6
capability detected · no path traced
—
Filesystem access.
repo/rust/wal3/src/bin/wal3-construct-garbage-from-manifest.rs:11
let manifest_json = std::fs::read_to_string(&args[0]).unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 56 locations
first-party (rust): rust/worker
rust first-partyexpand_more 209 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 201 locations
low env_fs — Environment-variable access. 8 locations
</> Dependencies
chromadb
rust dependencyexpand_more 643 low-confidence finding(s)
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 7 locations
low env_fs — Filesystem access. 35 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 580 locations
low env_fs — Environment-variable access. 21 locations
orjson
rust dependencyexpand_more 106 low-confidence finding(s)
low env_fs — Environment-variable access. 84 locations
low env_fs — Filesystem access. 22 locations
tokenizers
rust dependencyexpand_more 30 low-confidence finding(s)
low env_fs — Filesystem access. 28 locations
low env_fs — Environment-variable access. 2 locations
Skipped dependencies
Production
- next prod — tarball exceeds byte cap
- onnxruntime prod — no sdist (wheels only)
- matplotlib prod — sdist exceeds byte cap
- dotenv prod — no sdist (wheels only)
- github.com/stretchr/testify prod — scan budget exceeded
- github.com/testcontainers/testcontainers-go prod — scan budget exceeded
- github.com/testcontainers/testcontainers-go/modules/postgres prod — scan budget exceeded
- go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws prod — scan budget exceeded
- go.opentelemetry.io/otel prod — scan budget exceeded
- go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc prod — scan budget exceeded
- go.opentelemetry.io/otel/exporters/otlp/otlptrace prod — scan budget exceeded
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc prod — scan budget exceeded
- go.opentelemetry.io/otel/metric prod — scan budget exceeded
- go.opentelemetry.io/otel/sdk prod — scan budget exceeded
- go.opentelemetry.io/otel/sdk/metric prod — scan budget exceeded
- go.opentelemetry.io/otel/trace prod — scan budget exceeded
- go.uber.org/automaxprocs prod — scan budget exceeded
- go.uber.org/zap prod — scan budget exceeded
- google.golang.org/grpc prod — scan budget exceeded
- google.golang.org/protobuf prod — scan budget exceeded
- gorm.io/gorm prod — scan budget exceeded
- gorm.io/plugin/opentelemetry prod — scan budget exceeded
- k8s.io/apimachinery prod — scan budget exceeded
- k8s.io/client-go prod — scan budget exceeded
- pgregory.net/rapid prod — scan budget exceeded
- github.com/jackc/pgx/v5 prod — scan budget exceeded
- github.com/spaolacci/murmur3 prod — scan budget exceeded
- google.golang.org/genproto/googleapis/rpc prod — scan budget exceeded
- gorm.io/driver/postgres prod — scan budget exceeded
- k8s.io/api prod — scan budget exceeded
- arrow prod — scan budget exceeded
- bincode prod — scan budget exceeded
- criterion prod — scan budget exceeded
- futures prod — scan budget exceeded
- indicatif prod — scan budget exceeded
- parquet prod — scan budget exceeded
- rand prod — scan budget exceeded
- serde prod — scan budget exceeded
- serde_json prod — scan budget exceeded
- tantivy prod — scan budget exceeded
- tokio prod — scan budget exceeded
- anyhow prod — scan budget exceeded
- async-tempfile prod — scan budget exceeded
- async-compression prod — scan budget exceeded
- dirs prod — scan budget exceeded
- reqwest prod — scan budget exceeded
- tokio-stream prod — scan budget exceeded
- tokio-util prod — scan budget exceeded
- bloom prod — scan budget exceeded
- hf-hub prod — scan budget exceeded
- sprs prod — scan budget exceeded
- serde_bytes prod — scan budget exceeded
- bytes prod — scan budget exceeded
- thiserror prod — scan budget exceeded
- uuid prod — scan budget exceeded
- async-trait prod — scan budget exceeded
- roaring prod — scan budget exceeded
- parking_lot prod — scan budget exceeded
- tracing prod — scan budget exceeded
- shuttle prod — scan budget exceeded
- prost prod — scan budget exceeded
- tempfile prod — scan budget exceeded
- num_cpus prod — scan budget exceeded
- flatbuffers prod — scan budget exceeded
- itertools prod — scan budget exceeded
- opentelemetry prod — scan budget exceeded
- chroma-error prod — scan budget exceeded
- chroma-config prod — scan budget exceeded
- chroma-storage prod — scan budget exceeded
- chroma-cache prod — scan budget exceeded
- chroma-types prod — scan budget exceeded
- chroma-tracing prod — scan budget exceeded
- clap prod — scan budget exceeded
- foyer prod — scan budget exceeded
- mixtrics prod — scan budget exceeded
- serde_yaml prod — scan budget exceeded
- ahash prod — scan budget exceeded
- backon prod — scan budget exceeded
- bon prod — scan budget exceeded
- failsafe prod — scan budget exceeded
- murmur3 prod — scan budget exceeded
- rust-stemmers prod — scan budget exceeded
- chroma-api-types prod — scan budget exceeded
- figment prod — scan budget exceeded
- tonic prod — scan budget exceeded
- sqlx prod — scan budget exceeded
- validator prod — scan budget exceeded
- http prod — scan budget exceeded
- async-stream prod — scan budget exceeded
- axum prod — scan budget exceeded
- regex prod — scan budget exceeded
- rmcp prod — scan budget exceeded
- schemars prod — scan budget exceeded
- sha2 prod — scan budget exceeded
- tower-http prod — scan budget exceeded
- tree-sitter prod — scan budget exceeded
- tree-sitter-md prod — scan budget exceeded
- chroma prod — scan budget exceeded
- chroma-agent prod — scan budget exceeded
- chroma-metering prod — scan budget exceeded
- chroma-sysdb prod — scan budget exceeded
- chroma-system prod — scan budget exceeded
- frontend-core prod — scan budget exceeded
- mdac prod — scan budget exceeded
- http-body-util prod — scan budget exceeded
- lazy_static prod — scan budget exceeded
- tracing-opentelemetry prod — scan budget exceeded
- rust-embed prod — scan budget exceeded
- chroma-distance prod — scan budget exceeded
- chroma-log prod — scan budget exceeded
- chroma-memberlist prod — scan budget exceeded
- chroma-segment prod — scan budget exceeded
- chroma-sqlite prod — scan budget exceeded
- utoipa prod — scan budget exceeded
- utoipa-axum prod — scan budget exceeded
- utoipa-swagger-ui prod — scan budget exceeded
- strum prod — scan budget exceeded
- strum_macros prod — scan budget exceeded
- chrono prod — scan budget exceeded
- tonic-health prod — scan budget exceeded
- humantime prod — scan budget exceeded
- petgraph prod — scan budget exceeded
- base64 prod — scan budget exceeded
- tracing-subscriber prod — scan budget exceeded
- google-cloud-gax prod — scan budget exceeded
- google-cloud-spanner prod — scan budget exceeded
- chroma-blockstore prod — scan budget exceeded
- chroma-index prod — scan budget exceeded
- chroma-jemalloc-pprof-server prod — scan budget exceeded
- s3heap prod — scan budget exceeded
- s3heap-service prod — scan budget exceeded
- wal3 prod — scan budget exceeded
- bitpacking prod — scan budget exceeded
- bytemuck prod — scan budget exceeded
- hnswlib prod — scan budget exceeded
- simsimd prod — scan budget exceeded
- dashmap prod — scan budget exceeded
- half prod — scan budget exceeded
- usearch prod — scan budget exceeded
- faer prod — scan budget exceeded
- hyper prod — scan budget exceeded
- serde_yml prod — scan budget exceeded
- chroma-faults prod — scan budget exceeded
- kube prod — scan budget exceeded
- k8s-openapi prod — scan budget exceeded
- proc-macro2 prod — scan budget exceeded
- pin-project prod — scan budget exceeded
- quote prod — scan budget exceeded
- syn prod — scan budget exceeded
- chroma-metering-macros prod — scan budget exceeded
- aws-sdk-s3 prod — scan budget exceeded
- aws-smithy-types prod — scan budget exceeded
- aws-config prod — scan budget exceeded
- object_store prod — scan budget exceeded
- libc prod — scan budget exceeded
- sea-query prod — scan budget exceeded
- sea-query-binder prod — scan budget exceeded
- prost-types prod — scan budget exceeded
- derivative prod — scan budget exceeded
- tonic-prost prod — scan budget exceeded
- pyo3 prod — scan budget exceeded
- regex-syntax prod — scan budget exceeded
- serde-pickle prod — scan budget exceeded
- fastbloom prod — scan budget exceeded
- chroma-frontend prod — scan budget exceeded
- chroma-cli prod — scan budget exceeded
- siphasher prod — scan budget exceeded
- fastrace prod — scan budget exceeded
- fastrace-opentelemetry prod — scan budget exceeded
- opentelemetry-otlp prod — scan budget exceeded
- opentelemetry_sdk prod — scan budget exceeded
- rustls prod — scan budget exceeded
- md5 prod — scan budget exceeded
- arboard prod — scan budget exceeded
- colored prod — scan budget exceeded
- dialoguer prod — scan budget exceeded
- toml prod — scan budget exceeded
- webbrowser prod — scan budget exceeded
- semver prod — scan budget exceeded
- zip-extract prod — scan budget exceeded
- crossterm prod — scan budget exceeded
- ratatui prod — scan budget exceeded
- tui-input prod — scan budget exceeded
- textwrap prod — scan budget exceeded
- supports-color prod — scan budget exceeded
- setsum prod — scan budget exceeded
- napi prod — scan budget exceeded
- napi-derive prod — scan budget exceeded
- jemalloc_pprof prod — scan budget exceeded
- mappings prod — scan budget exceeded
- indexmap prod — scan budget exceeded