Close Open Privacy Scan

bolt Snapshot: commit abd068b
science engine v1.23
schedule 2026-07-26T09:09:35.850741+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

62 /100
Medium privacy risk

Medium risk · 2372 finding(s)

Based on: 1 first-party package(s) · 26/39 deps analyzed

Dependency score: 72 (Medium risk)

bar_chart Score Breakdown

telemetry −25
egress −10
env_fs −3

list Scan Summary

0 high 46 medium 2326 low
First-party packages: 1
Dependency packages: 24
Ecosystem: python

swap_horiz External domains

abseil.ioacademic.oup.comaclweb.orgaddress.localaggregate.ee.engr.uky.eduai.stanford.eduaosabook.orgapi.github.comapi.nuget.orgarchive.ics.uci.eduarrow.apache.orgartowen.su.domainsarxiv.orgbitbucket.orgblog.keras.ioblog.tensorflow.orgblogs.msdn.microsoft.combmva-archive.org.ukbpa.stbugreports.qt.iobugs.python.orgbugs.winehq.orgbugzilla.gnome.orgccm.ucdenver.educdn.datatables.netcdn.jsdelivr.netcdn.mathjax.orgcdnjs.cloudflare.comcens.ioc.eecgi.di.uoa.grciteseerx.ist.psu.educode.google.comcode.jquery.comcolab.research.google.comcolab.sandbox.google.comcollaboration.cmc.ec.gc.caconemu.github.iocoverage.readthedocs.iocoverage.rtfd.iocran.r-project.orgcran.rstudio.comcrates.iocreativecommons.orgcs.nyu.educs229.stanford.educseweb.ucsd.educve.mitre.orgdata-apis.orgdevblogs.nvidia.comdeveloper.android.comdeveloper.mozilla.orgdevelopers.google.comdigitalassets.lib.berkeley.edudl.acm.orgdl.google.comdlmf.nist.govdm-haiku.readthedocs.iodm-pix.readthedocs.iodmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdocs.bodo.aidocs.h5py.orgdocs.jax.devdocs.kidger.sitedocs.microsoft.comdocs.nvidia.comdocs.pytest.orgdocs.python.orgdocs.rsdocs.scipydocs.scipy.orgdocs.sqlalchemy.orgdoi.orgdspace.mit.eduen.wikipedia.orgen.wikiversity.orgepub.ub.uni-muenchen.deepubs.siam.orgexslt.orgfa.bianp.netflax-linen.readthedocs.ioflax.readthedocs.iofunctions.wolfram.comgcc.gnu.orggithub.comgitlab.freedesktop.orggo.devgoogle.github.iographics.stanford.edugraphviz.gitlab.iogroups.google.comhachyderm.iohal.archives-ouvertes.frhal.inria.frhastie.su.domainshg.python.orghome.olemiss.eduhomepages.ecs.vuw.ac.nzhtk.eng.cam.ac.ukhtml.spec.whatwg.orghttpbin.orghuggingface.coi.stanford.eduicl.utk.eduieeexplore.ieee.orgimageio.readthedocs.ioinf.ufrgs.bripython.orgj3-fortran.orgjakevdp.github.iojax.readthedocs.iojmlr.csail.mit.edujmlr.orgjoblib.readthedocs.iojournals.plos.orgkeras.iolib.stat.cmu.edulibsdl.orglink.springer.comlivelovely.comllvm.orglustre.googleapis.comlvdmaaten.github.iomartin-thoma.commathworld.wolfram.commatplotlib.orgmedium.commerlinux.eumesonbuild.commetacpan.orgmicrosoft.commicrosoft.github.iomitpress.mit.edumybinder.orgnarwhals-dev.github.iondownloader.figshare.comnedbatchelder.comnicolas.limare.netnlp.stanford.edunumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnumpydoc.readthedocs.ioonnx.aionnxruntime.aiopenreview.netopensource.orgopenxla.orgoptax.readthedocs.ioorbax.readthedocs.iopackages.msys2.orgpackaging.python.orgpages.cs.wisc.edupandas.pydata.orgpapers.nips.ccparquet.apache.orgpeople.cs.umass.edupeople.csail.mit.edupeople.eecs.berkeley.edupeople.iee.ihu.grpeople.sc.fsu.edupeps.python.orgpersonal.math.ubc.capillow.readthedocs.iopip.pypa.iopluggy.readthedocs.iopre-commit.compresbrey.mit.eduproceedings.mlr.pressproceedings.neurips.ccprojecteuclid.orgprotobuf.devpy.readthedocs.iopybites.blogspot.bepygments.orgpyinstaller.readthedocs.iopyperclip.readthedocs.iopypi.anaconda.orgpypi.orgpytest.orgpythontesting.netpytorch.orgraw.githubusercontent.comreadthedocs.orgrefspecs.linuxfoundation.orgrequests.readthedocs.ioresearch.google.comrich.readthedocs.iorob.schapire.netschemas.microsoft.comscikit-image.orgscikit-learn.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgsdm.lbl.govseaborn.pydata.orgsetuptools.pypa.iosh.rustup.rsskops.readthedocs.iosourceware.orgsparse.pydata.orgspecs.frictionlessdata.iostackoverflow.comstat.uw.edustats.stackexchange.comstatweb.stanford.edustorage.googleapis.comstoragetransfer.googleapis.comsupport.sas.comtc39.estidelift.comtinyurl.comtminka.github.iotox.wikitruststore.readthedocs.iotwitter.comtyping.python.orgui.perfetto.devusers.iems.northwestern.eduusers.jyu.fivassarstats.netviews.scientific-python.orgvirtualenv.pypa.iovis-www.cs.umass.eduweb.archive.orgweb.stanford.eduwiki.haskell.orgwin.rustup.rswixtoolset.orgwrapdb.mesonbuild.comwww.131002.netwww.ams.orgwww.bestofmedia.comwww.biostat.wisc.eduwww.cl.cam.ac.ukwww.cs.cmu.eduwww.cs.cornell.eduwww.cs.princeton.eduwww.cs.sfu.cawww.cs.technion.ac.ilwww.cs.toronto.eduwww.cs.ucl.ac.ukwww.cs.waikato.ac.nzwww.csie.ntu.edu.twwww.data-publica.comwww.dbs.ifi.lmu.dewww.di.ens.frwww.ecma-international.orgwww.eecs.tufts.eduwww.fordfoundation.orgwww.gaussianprocess.orgwww.github.comwww.godbole.netwww.google.comwww.googleapis.comwww.h5py.orgwww.intel.comwww.isca-archive.orgwww.iucnredlist.orgwww.jmlr.orgwww.jstage.jst.go.jpwww.jstatsoft.orgwww.jstor.orgwww.manning.comwww.mars.comwww.math.hmc.eduwww.mathjax.orgwww.mathworks.comwww.matthewzeiler.comwww.microsoft.comwww.miketipping.comwww.mit.eduwww.mitpressjournals.orgwww.mlpack.orgwww.ncbi.nlm.nih.govwww.oasis-open.orgwww.openblas.netwww.opencompute.orgwww.openml.orgwww.openxla.orgwww.opm.govwww.oreilly.comwww.python.orgwww.research.ibm.comwww.researchgate.netwww.robots.ox.ac.ukwww.sciencedirect.comwww.scipy.orgwww.springer.comwww.sri.comwww.stat.berkeley.eduwww.stata.comwww.statsmodels.orgwww.stixfonts.orgwww.tandfonline.comwww.tensorflow.orgwww.textualize.iowww.thesalmons.orgwww.utstat.toronto.eduwww.w3.orgwww.xyz.eduwww.yhat.comxarray.pydata.orgxlrd.readthedocs.ioyann.lecun.com

</> First-Party Code

first-party (python)

python first-party
medium telemetry production #a0552023aa2e3b9b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/litert.py:148
            archive.track(self.model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #d3baa3ca59a73557 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_export_archive.py:190
        self.track(resource)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #9a0775aaabdefda1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:437
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #afd74f5ce84daf4f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:443
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #33343da7334bf89d capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:469
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #24be403b50867a4e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:514
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #61fc60258547b330 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:581
            export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #55d445e90fe6630c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:591
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #6b93c7b1d0fbf3a8 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:624
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #3cccc3b1f5ab9300 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:688
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #1eda1d70bd1699ec capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:770
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #c37ae1db61aa0f00 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:803
        export_archive.track(layer)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #1fe4255af51ddfb1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:981
        export_archive.track(layer)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #cdd89c1e12443a4f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1005
        export_archive.track(layer)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #77cce62d4af364e2 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1041
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #bce7869f921f9e9a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1078
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #6431c4c8b0d221dd capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1095
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #4ccdfb287607721b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1102
            export_archive.track("model")

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #13c6d2bf5dbb1db5 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1106
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #bec98b6463b2eac2 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1114
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #4685dc8933da5139 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1121
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #ee69febce4646a4c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/saved_model_test.py:1184
        export_archive.track(lookup_table)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #09894f05a1b27b60 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/export/tfsm_layer_test.py:80
        export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #08b05f83b6d8d581 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/layers/layer.py:1632
            value = self._tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #2c8edaab719c6389 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/metrics/metric.py:240
            value = self._tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #5f7a47c322f9987e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/models/functional.py:142
            self._tracker.track(layer)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #77b3a961a3e1bb9c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/optimizers/base_optimizer.py:1105
            value = self._tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #2144625315d7457e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:88
                wrapped_attr[name] = self.track(e)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #b3ac808b7f7722e4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:93
                wrapped_attr.append(self.track(e))

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #7df9dd275905e8bd capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:143
            values = [tracker.track(v) for v in values]

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #73611f8acf4c9e2b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:148
            self.tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #2549d58168418f8c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:153
            self.tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #0672abdbfae9a894 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:158
            values = [self.tracker.track(v) for v in values]

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #17d95f2d48250b30 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:232
            values = {k: tracker.track(v) for k, v in items_iter}

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #a2e9f1e58c861e07 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:237
            self.tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #99c7d58fcb3d823d capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:242
            mapping = {k: self.tracker.track(v) for k, v in mapping.items()}

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #b66be9a3737a4eb4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:319
            values = OrderedDict((k, tracker.track(v)) for k, v in items_iter)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #93f3089abb5bda52 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:324
            self.tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #45f0ee283426c995 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:330
                (k, self.tracker.track(v)) for k, v in mapping.items()

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #ab9f3810a234c34f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:394
            values = {tracker.track(v) for v in values}

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #af835ecd7758af56 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:399
            self.tracker.track(value)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #7042b6e39a18bcbd capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking.py:404
            values = [self.tracker.track(v) for v in values]

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #7a18768966b1b7e6 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking_test.py:73
        tup = tracker.track(tup)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #62d2e12b6c8423a1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking_test.py:93
        tup = tracker.track(tup)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #63156f69da626df1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/keras/src/utils/tracking_test.py:164
        ordered_dict = tracker.track(input_ordered)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 162 low-confidence finding(s)
low env_fs Filesystem access. 91 locations
low env_fs Environment-variable access. 69 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations

</> Dependencies

rich

python dependency
medium telemetry dependency Excluded from app score #951c38230db26d8a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/rich/progress.py:173
        yield from progress.track(
            sequence,
            total=total,
            completed=completed,
            description=description,
            update_period=update_period,
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 22 low-confidence finding(s)

absl-py

python dependency
expand_more 28 low-confidence finding(s)
low env_fs Environment-variable access. 20 locations
low env_fs Filesystem access. 8 locations

coverage

python dependency
expand_more 93 low-confidence finding(s)
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
low env_fs Environment-variable access. 50 locations
low env_fs Filesystem access. 40 locations

dm_tree

python dependency
expand_more 5 low-confidence finding(s)

flax

python dependency
expand_more 21 low-confidence finding(s)
low env_fs Environment-variable access. 12 locations
low env_fs Filesystem access. 7 locations
low egress tooling Excluded from app score unreachable #7903f9fb36218423 capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/.github/analytics/get_repo_metrics.py:89
  response = requests.post(endpoint, json=payload, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low pii_flow tooling Excluded from app score unreachable #6bd4081a964864b1 A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/.github/analytics/get_repo_metrics.py:89 · flow /tmp/closeopen-bvuprfem/pkgs/python/[email protected]/.github/analytics/get_repo_metrics.py:26 → /tmp/closeopen-bvuprfem/pkgs/python/[email protected]/.github/analytics/get_repo_metrics.py:89
  response = requests.post(endpoint, json=payload, headers=headers)

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

jax

python dependency
expand_more 139 low-confidence finding(s)
low env_fs Environment-variable access. 109 locations
low egress dependency Excluded from app score #06f7df558fe5aef1 capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/jax/_src/clusters/cloud_tpu_cluster.py:45
    api_resp = requests.get(
        f'{gce_metadata_endpoint}/computeMetadata/v1/instance/attributes/{key}',
        headers={'Metadata-Flavor': 'Google'}, timeout=60)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs Filesystem access. 29 locations

jax2onnx

python dependency
expand_more 44 low-confidence finding(s)
low env_fs Environment-variable access. 39 locations
low env_fs Filesystem access. 5 locations

numpy

python dependency
expand_more 982 low-confidence finding(s)
low env_fs Filesystem access. 618 locations
low env_fs Environment-variable access. 356 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 3 locations

orbax-checkpoint

python dependency
expand_more 108 low-confidence finding(s)
low env_fs Filesystem access. 57 locations
low env_fs Environment-variable access. 40 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 10 locations
low egress dependency Excluded from app score #f8446d725504232d capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/orbax/checkpoint/experimental/tiering_service/gcp_storage_client.py:250
    response = await self.async_client.post(url, json=payload, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

packaging

python dependency

pandas

python dependency
expand_more 29 low-confidence finding(s)
low env_fs Filesystem access. 12 locations
low env_fs Environment-variable access. 16 locations
low egress dependency Excluded from app score #e1dad067ba39e3e8 capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pandas/io/common.py:282
    return urllib.request.urlopen(*args, **kwargs)  # noqa: TID251

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pre-commit

python dependency
expand_more 58 low-confidence finding(s)
low env_fs Environment-variable access. 25 locations
low env_fs Filesystem access. 31 locations
low egress dependency Excluded from app score #83af976357624eaa capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/pre_commit/languages/golang.py:92
    resp = urllib.request.urlopen('https://go.dev/dl/?mode=json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7df710ce31d798f0 capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pre_commit/languages/golang.py:104
        resp = urllib.request.urlopen(_get_url(version))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

protobuf

python dependency
expand_more 3 low-confidence finding(s)
low env_fs Environment-variable access. 2 locations
low env_fs dependency Excluded from app score #d5f289dbebb4889a capability detected · no path traced Filesystem access.
pkgs/python/[email protected]/setup.py:28
  with open(os.path.join('google', 'protobuf', '__init__.py')) as version_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytest

python dependency
expand_more 437 low-confidence finding(s)
low env_fs Environment-variable access. 76 locations
low env_fs Filesystem access. 356 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 2 locations

pytest-cov

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #6ec42008d1da0bf2 capability detected · no path traced Filesystem access.
pkgs/python/[email protected]/ci/bootstrap.py:68
            destination.write_text(jinja.get_template(template_path).render(tox_environments=tox_environments))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ecda5b07ec8ebbaa capability detected · no path traced Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:13
if os.getenv('SPELLCHECK'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytest-xdist

python dependency
expand_more 26 low-confidence finding(s)
low env_fs Environment-variable access. 7 locations
low env_fs Filesystem access. 19 locations

scikit-learn

python dependency
expand_more 52 low-confidence finding(s)
low env_fs Environment-variable access. 25 locations
low env_fs Filesystem access. 25 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations

tf2onnx

python dependency
expand_more 38 low-confidence finding(s)
low env_fs Filesystem access. 32 locations
low env_fs Environment-variable access. 5 locations
low egress dependency Excluded from app score #33d850ef2dff113b capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/tf2onnx/utils.py:563
    response = session.get(url, allow_redirects=True)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

Skipped dependencies

Production

  • tensorflow-cpu prod — no sdist (wheels only)
  • tensorflow prod — no sdist (wheels only)
  • ai-edge-litert prod — no sdist (wheels only)
  • torch prod — no sdist (wheels only)
  • torch-xla prod — no sdist (wheels only)
  • openvino prod — no sdist (wheels only)
  • scipy prod — sdist exceeds byte cap
  • pillow prod — sdist exceeds byte cap
  • tensorboard prod — no sdist (wheels only)
  • tensorboard-plugin-profile prod — no sdist (wheels only)
  • onnxruntime prod — no sdist (wheels only)
  • grain prod — no sdist (wheels only)
  • litert-torch prod — no sdist (wheels only)