Close Open Privacy Scan
App Privacy Score
82
/100
Low privacy risk
Low risk · 2059 finding(s)
Based on: 2 first-party package(s) · 10/13 deps analyzed
Dependency score: 47 (High risk)
bar_chart Score Breakdown
egress
−15
env_fs
−3
list Scan Summary
0 high
3 medium
2056 low
First-party packages:
2
Dependency packages:
10
Ecosystem:
python
swap_horiz Application data flows
No application data flows were found. See dependency data flows below.
hub Dependency data flows (1)
medium
transformers
dependency
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
- 1source
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 - 2sink
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
</> First-Party Code
first-party (python)
python first-partyexpand_more 381 low-confidence finding(s)
low env_fs — Environment-variable access. 172 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 19 locations
low env_fs — Filesystem access. 190 locations
first-party (python): megatron/core/distributed/fsdp/src
python first-partyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
</> Dependencies
accelerate
python dependency
medium
telemetry
dependency
Excluded from app score
#a2712517ba430b8b
capability detected · no path traced
—
Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/accelerate/tracking.py:650
self.writer.track(value, name=key, step=step, **kwargs)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium
telemetry
dependency
Excluded from app score
#4eb2f653ae0bf9fc
capability detected · no path traced
—
Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/accelerate/tracking.py:682
self.writer.track(aim_image, name=key, step=step, **track_kw)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 226 low-confidence finding(s)
low env_fs — Filesystem access. 31 locations
low env_fs — Environment-variable access. 195 locations
transformers
python dependency
medium
pii_flow
dependency
Excluded from app score
#a3860b2521ad3d5f
—
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
· flow /tmp/closeopen-bsghf211/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 → /tmp/closeopen-bsghf211/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
logger.debug(f"[Kubeflow] Token file not found: {token_path}")PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 399 low-confidence finding(s)
low env_fs — Filesystem access. 249 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 13 locations
low env_fs — Environment-variable access. 136 locations
low
egress
dependency
Excluded from app score
#80e63d8f888b2e3a
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/transformers/utils/attention_visualizer.py:183
img = Image.open(io.BytesIO(httpx.get(img, follow_redirects=True).content))Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
causal-conv1d
python dependencyexpand_more 11 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low env_fs — Environment-variable access. 9 locations
flask-restful
python dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
mamba-ssm
python dependencyexpand_more 18 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 14 locations
numpy
python dependencyexpand_more 982 low-confidence finding(s)
low env_fs — Filesystem access. 618 locations
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57
low env_fs — Environment-variable access. 356 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 3 locations
omegaconf
python dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 3 locations
packaging
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
sentencepiece
python dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Filesystem access. 9 locations
low
env_fs
dependency
Excluded from app score
#3539a155bb32f04b
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/setup.py:276
if os.getenv('PYTHON_ARCH', '') == 'ARM64':Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tiktoken
python dependencyexpand_more 16 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
low env_fs — Filesystem access. 8 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
Skipped dependencies
Production
- torch prod — no sdist (wheels only)
- wandb prod — sdist exceeds byte cap
- transformer-engine prod — no sdist (wheels only)