Close Open Privacy Scan
App Privacy Score
Medium risk · 130 finding(s)
Based on: 1 first-party package(s) · 15/16 deps analyzed
Dependency score: 57 (Medium risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
api.figma.comdevelopers.figma.comgithub.comjson-schema.orgposthog.comsentry.ious.i.posthog.comwww.framelink.ai
</> First-Party Code
first-party (npm)
npm first-partyimport { PostHog } from "posthog-node";A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 28 low-confidence finding(s)
low env_fs — Filesystem access. 11 locations
low env_fs — Environment-variable access. 15 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
</> Dependencies
posthog-node
npm dependency posthog.withContext(buildRequestContextData(posthog, req), () => next())A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
posthog.addPendingPromise(
ErrorTracking.buildEventMessage(
posthog.getErrorPropertiesBuilder(),
error,
hint,
contextData.distinctId,
additionalProperties
).then((msg) => {
return posthog._capturePreparedEvent(msg, false)
})
)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
posthog.getErrorPropertiesBuilder(),A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
return posthog._capturePreparedEvent(msg, false)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 2 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
@jimp/core
npm dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
const [fetchErr, response] = await to(fetch(url));Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
@modelcontextprotocol/sdk
npm dependencyexpand_more 38 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 22 locations
const response = await fetch(url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
writeFileSync(outputPath, fullContent, 'utf-8');Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 14 locations
cross-env
npm dependencyexpand_more 15 low-confidence finding(s)
low env_fs — Environment-variable access. 15 locations
dotenv
npm dependencyexpand_more 18 low-confidence finding(s)
low env_fs — Environment-variable access. 16 locations
low env_fs — Filesystem access. 2 locations
express
npm dependencyexpand_more 1 low-confidence finding(s)
var env = process.env.NODE_ENV || 'development';Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
js-yaml
npm dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
remeda
npm dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Filesystem access. 5 locations
undici
npm dependencyexpand_more 13 low-confidence finding(s)
low env_fs — Environment-variable access. 7 locations
return session.request(headers, options)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs — Filesystem access. 5 locations
Skipped dependencies
Production
- @figma/rest-api-spec prod — dist-only: no readable source