Close Open Privacy Scan

link https://github.com/sgl-project/sglang
bolt Snapshot: commit 10908a6
science engine v1.21
schedule 2026-07-18T19:12:53.841064+00:00

help Not analyzed — coverage too low to judge

Too little of this repository was analyzed to judge — 106/215 dependencies were scanned. This is not a clean result; it means the scan could not run far enough to reach one.

smart_toy MCP server detected: anthropic, openai, rmcp — detected in dependencies, not a safety judgment.

App Privacy Score

— /100
Not analyzed — coverage too low

Coverage too low to score · 418 finding(s)

bar_chart Score Breakdown

telemetry −25
env_fs −3

list Scan Summary

0 high 0 medium 418 low
First-party packages: 4
Dependency packages: 13
Ecosystem: rust

swap_horiz Application data flows

Not enough of this repository was analyzed to look for application data flows. Absence of findings here is not evidence of a clean result.

</> First-Party Code

first-party (rust): experimental/sgl-router

rust first-party
expand_more 69 low-confidence finding(s)
low telemetry production #2ed4d0258830a82c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/k8s.rs:301 
                tracing::warn!(error = ?e, "k8s watcher error; awaiting auto-restart");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #489407ae546520f3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/k8s.rs:306 
            tracing::info!("k8s discovery: event channel closed; exiting watcher");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #498b2d514e8578ec — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/k8s.rs:310 
    tracing::warn!("k8s watcher stream ended; discovery task exiting");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #dc9ef7a771e5c29f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/k8s.rs:370 
        K8sDiscoveryMode::Plain { label_selector } => tracing::info!(
            namespace = %namespace_display,
            label_selector = %label_selector,
            "k8s discovery starting (plain mode); a wrong namespace or selector matches zero EndpointSlices"
        ),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ecf9abc921a7d9e6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/k8s.rs:378 
        } => tracing::info!(
            namespace = %namespace_display,
            prefill_selector = %prefill_selector,
            decode_selector = %decode_selector,
            "k8s discovery starting (PD mode); a wrong namespace or selector matches zero EndpointSlices"
        ),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d5bb656ab62515c7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/static_urls.rs:48 
                tracing::info!(
                    "static_urls discovery: event channel closed during fan-out; exiting"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3a6abdfc1a5037a3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/static_urls.rs:54 
        tracing::debug!(
            "static_urls discovery: initial fan-out complete; parking until channel closes"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a7d87a5e99933b53 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/discovery/static_urls.rs:69 
        tracing::info!(
            "static_urls discovery: event channel closed by receiver \
             (worker manager dropped its end, or shutdown abort raced); exiting"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #000acfd2fea8a0e3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/main.rs:39 
        tracing::debug!(
            default_level = %default_level,
            ?format,
            error = %e,
            "tracing subscriber already installed; continuing"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #0f58fc8badc569ce — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/main.rs:88 
    tracing::info!(
        "sgl-router {} starting on {}:{}",
        env!("CARGO_PKG_VERSION"),
        cfg.server.host,
        cfg.server.port
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3fd73fd212d1cec4 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/main.rs:184 
    tracing::info!("listening on {bind}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a52754216e4f13a2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/active_load.rs:395 
                tracing::warn!(
                    request_id = %id,
                    worker = %entry.worker,
                    prefill_load = entry.prefill_load,
                    decode_load = entry.decode_load,
                    "stale request swept by active-load janitor",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #7a111b9c8b792332 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/cache_aware_zmq.rs:197 
        tracing::debug!(
            model = %ctx.model(),
            hashing = if is_bigram { "bigram" } else { "unigram" },
            n_blocks = block_hashes.len(),
            matched_blocks = matched.matched_blocks,
            match_rate,
            cache_threshold = self.config.cache_threshold,
            "cache-aware-zmq match_prefix",
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #aeaf6d0ce84deee6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/cache_aware_zmq.rs:215 
            tracing::debug!(
                model = %ctx.model(),
                match_rate,
                cache_threshold = self.config.cache_threshold,
                "cache-aware-zmq: overlap below threshold, falling back to min-load",
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #2687abc3e056c01a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/cache_aware_zmq.rs:233 
            tracing::debug!(
                model = %ctx.model(),
                worker = %w.url,
                matched_blocks = matched.matched_blocks,
                "cache-aware-zmq: selected worker by cache overlap",
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4043567c69334350 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/kv_events/block_size_oracle.rs:109 
                tracing::warn!(
                    established_bigram = existing == BIGRAM_BIGRAM,
                    worker_bigram = is_bigram,
                    "kv-events: worker hashing mode (bigram/EAGLE) disagrees with the \
                     established cluster value; keeping the first. A heterogeneous \
                     EAGLE/non-EAGLE cluster will silently never match cache for the \
                     minority workers — check that all workers run the same model.",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f9863c3f195799a9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/kv_events/discovery.rs:227 
                tracing::warn!(
                    worker_url = %worker_url,
                    speculative_algorithm = %algo,
                    "kv-events: unrecognized EAGLE-like speculative_algorithm; treating as \
                     non-bigram (unigram) hashing. If this is an EAGLE-family algorithm, \
                     cache-aware routing will silently never match — add it to classify_bigram",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #86b13b9da4e6953a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/mod.rs:100 
            tracing::warn!(
                model = %model_id,
                error = %e,
                "ingress tokenize failed; routing/forwarding skips this prompt",
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #fe42b650116a235f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/policies/sticky.rs:127 
            tracing::debug!(
                "StickyPolicy constructed outside a Tokio runtime; idle eviction is disabled"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #2cf5550af17f5739 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/proxy/mod.rs:131 
                tracing::warn!(
                    upstream = %url,
                    status = %status,
                    error = ?e,
                    "upstream dropped connection mid-body",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a580f8d0d9b8982f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/proxy/sse.rs:94 
                    tracing::warn!(error = %msg, "upstream SSE stream errored mid-flight");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #161ca57917a63b0d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/proxy/sse.rs:116 
                        tracing::debug!("SSE client disconnected mid-stream");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #b3f03e82f3deeb6c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/proxy/sse.rs:134 
            tracing::error!(error = %msg, "SSE pump task panicked");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f8ead14cdee58388 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/app.rs:43 
        tracing::warn!(
            %method,
            %uri,
            "request rejected with 413 PAYLOAD_TOO_LARGE (body exceeded route limit)",
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4c0a9fc71e84b603 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:182 
                tracing::error!("internal error serving request: {e:#}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3068a7d80fd414ce — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:186 
                tracing::warn!(
                    upstream = %worker,
                    error = %format_args!("{source:#}"),
                    "upstream worker unreachable",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e23be490286556fb — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:194 
                tracing::warn!(
                    upstream_status = %status,
                    "upstream returned an error status",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4440b4907f1bcd6e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:201 
                tracing::warn!(upstream = %worker, "upstream request timed out");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #34672a73543cbe56 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:205 
                tracing::warn!(model = %model, reason = "no_healthy_workers", "service unavailable");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8bcd7dfe4570e85b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:209 
                tracing::warn!(
                    model = %model,
                    reason = "no_prefill_workers_available",
                    "service unavailable",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #b2a187c08e7688f6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:217 
                tracing::warn!(
                    model = %model,
                    reason = "no_decode_workers_available",
                    "service unavailable",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #0638167dd047b70a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:225 
                tracing::warn!(
                    model = %model,
                    reason = "stale_request_expired",
                    "stale-request janitor expired in-flight request",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d276ebe051d1e315 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:233 
                tracing::warn!(model = %model, reason = "policy_selection_failed", "service unavailable");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d69c38af49133af2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:237 
                tracing::warn!(upstream = %worker, reason = "breaker_open", "service unavailable");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5b38cb8ab0b94ef8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/error.rs:241 
                tracing::error!(
                    upstream = %worker,
                    error = %format_args!("{source:#}"),
                    "worker URL emitted by discovery is malformed",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a6ab735126776c24 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/cache.rs:95 
        tracing::warn!("flush_cache called but no workers are registered");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3e7bb690934700a8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/cache.rs:110 
        tracing::info!(total_workers, "flush_cache: all workers flushed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #1699a91fe3d00d1b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/cache.rs:112 
        tracing::warn!(
            total_workers,
            succeeded = successful.len(),
            failed = failed.len(),
            "flush_cache: some workers failed to flush",
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ac4032389f144c17 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/chat.rs:241 
                tracing::warn!(
                    decode_url = %url,
                    error = %e,
                    "decode worker URL rejected by header parser; sending request without decode hint",
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4bca315b08a085c3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/chat.rs:425 
                Ok(_) => tracing::debug!(
                    prefill_url = %prefill_url,
                    bootstrap_room,
                    "prefill side completed",
                ),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3144c982af8c84f5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/chat.rs:430 
                Err(e) => tracing::warn!(
                    prefill_url = %prefill_url,
                    bootstrap_room,
                    error = %e,
                    "prefill request failed; decode will time out on bootstrap_room",
                ),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4ab881d27b434ce5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/chat.rs:581 
    tracing::info!(
        request_id = %request_id,
        method = "POST",
        path = "/v1/chat/completions",
        model = %metrics_model,
        worker = %metrics_worker_url,
        outcome = outcome_str,
        http_status,
        stream = streaming,
        latency_ms = elapsed.as_millis() as u64,
        "chat_completions",
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6a1766d1cfb0005b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/chat.rs:610 
                    tracing::warn!(
                        decode_url = %url,
                        error = %e,
                        "decode worker URL rejected by header parser on response; omitting response-side hint",
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6f3fff410c77be2c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/chat.rs:900 
        tracing::debug!(error = %e, "chat-completions body rejected as non-object JSON");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #95c8d29542dee73a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/chat.rs:904 
        tracing::debug!(error = %e, "chat-completions request-probe deserialize failed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #79f6483e7114c0b7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/tokenize.rs:58 
        tracing::error!(
            route = "/v1/tokenize",
            model = %req.model,
            prompt_len = req.prompt.len(),
            error = ?e,
            "tokenize.encode failed",
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a0dc440321164c59 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/server/routes/tokenize.rs:84 
            tracing::error!(
                route = "/v1/detokenize",
                model = %req.model,
                n_tokens = req.tokens.len(),
                skip_special = req.skip_special_tokens,
                error = ?e,
                "detokenize.decode_complete failed",
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #95cc16f84d82cdbe — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/adapter.rs:94 
                tracing::warn!(repo = %source, error = %e,
                    "could not download tokenizer_config.json; chat-template routing disabled for this model \
                     (expected if the repo ships none — otherwise check HF_TOKEN / network for a gated or private repo)");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #48a95ad1ecfec599 — Filesystem access.
repo/experimental/sgl-router/src/tokenizer/adapter.rs:104 
    let bytes = std::fs::read(&path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #c4d099ffd7586ef2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/adapter.rs:131 
            tracing::debug!(
                n_tokens = ids.len(),
                trailing_bytes = s.len(),
                "decode_complete: tokenizer returned Partial for non-streaming call"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #2414446a1d6e9bba — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/mod.rs:58 
            tracing::warn!(model = %model_id, %cause,
                "chat-encoder failed; falling back to raw prompt-text hashing \
                 (cache-aware overlap degrades for this model; further failures log at debug)");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #0cab56ddc5108332 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/mod.rs:62 
            tracing::debug!(model = %model_id, %cause,
                "chat-encoder failed; falling back to raw prompt-text hashing");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #520a0964cde9c271 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/mod.rs:112 
                    tracing::info!(model = %model_id,
                        "chat-template routing enabled; chat requests route by templated tokens");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #9d3a18f8ac751c4d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/mod.rs:117 
                Err(e) => tracing::warn!(model = %model_id, error = %e,
                    "failed to compile chat template; falling back to built-in detection"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5ec756783eccc4c6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/mod.rs:121 
            Err(e) => tracing::warn!(model = %model_id, error = %e,
                "failed to load tokenizer_config.json; falling back to built-in detection"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #b4f0ea8cc865f1ac — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/mod.rs:125 
            tracing::info!(model = %model_id,
                "DeepSeek-V4 routing enabled; chat requests route via the built-in V4 encoder");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6b1348763eca653f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/tokenizer/mod.rs:129 
        tracing::info!(model = %model_id,
            "no chat template or built-in encoder; chat traffic routes via raw prompt text");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #b8762f827d99b450 — Filesystem access.
repo/experimental/sgl-router/src/tokenizer/mod.rs:379 
        std::fs::write(&tok, "{}").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #766568948826b91b — Filesystem access.
repo/experimental/sgl-router/src/tokenizer/mod.rs:380 
        std::fs::write(
            dir.path().join("tokenizer_config.json"),
            r#"{"chat_template":"X","bos_token":"<s>"}"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5be1d49d5c3983e9 — Filesystem access.
repo/experimental/sgl-router/src/tokenizer/mod.rs:395 
        std::fs::write(&tok, "{}").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #08570ad5386eb3d2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:217 
            tracing::info!("discovery: +worker {} ({:?})", spec.id, spec.mode);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6b7e75ce16756b20 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:236 
            tracing::info!("discovery: -worker {id}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #b85513420035771f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:258 
                    tracing::warn!(
                        id = %id,
                        "discovery: Removed without a known URL; kv-events state (if any) not cleared",
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5eb04ca1d5a47cbf — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:292 
                    tracing::info!("discovery: ~worker {id} mode→{mode:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #fb64eb80e865a67b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:296 
                    tracing::warn!(
                        id = %id,
                        mode = ?mode,
                        "discovery: ModeChanged for unknown worker — out-of-order event from backend",
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5f80b68c10321f37 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:368 
        tracing::debug!(
            worker_id = %id,
            worker_url = %worker.url,
            "reconcile: re-introspecting worker that registered without model_ids",
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3d01dcb4251c1998 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:419 
            tracing::info!(
                worker_url = %worker_url,
                backend_mode = ?spec.mode,
                resolved_mode = ?new_mode,
                backend_bootstrap_port = ?spec.bootstrap_port,
                resolved_bootstrap_port = ?new_port,
                "/server_info overrode discovery-backend classification",
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #00be1afa8418e234 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/manager.rs:439 
        tracing::error!(
            worker_url = %worker_url,
            error = %e,
            "worker manager: refused to register worker due to mixed PD/plain configuration",
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #fdb694c755b95341 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/experimental/sgl-router/src/workers/worker.rs:27 
    tracing::warn!(
        worker_url = %url,
        "Failed to parse worker URL for bootstrap_host; defaulting to 'localhost'"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

first-party (rust): rust/sglang-grpc

rust first-party
expand_more 26 low-confidence finding(s)
low env_fs production #fd02cecdeab59150 — Environment-variable access.
repo/rust/sglang-grpc/build.rs:9 
            std::path::PathBuf::from(std::env::var("OUT_DIR").unwrap())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #69f4910197fb7ee9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/bridge.rs:79 
        tracing::warn!(mutex = name, "Recovering from poisoned gRPC bridge mutex");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #108261bb811ef6c8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/bridge.rs:237 
            tracing::debug!(affected, "gRPC abort_all cleared active response channels");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #73edce9f916c2fce — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/bridge.rs:247 
                tracing::debug!(rid, "Ignoring abort for inactive gRPC request id");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #40c6318fe3f300bf — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/bridge.rs:494 
        tracing::warn!(rid, "gRPC on_ready callback failed: {}", err);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d354d9bebb55fea6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/bridge.rs:543 
                tracing::warn!(
                    rid,
                    "gRPC bridge received another chunk before the parked chunk drained; closing stream"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #93ba64f78b2628ea — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:61 
        tracing::debug!("{}.{} is unavailable: {}", context, attr, err);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #322a4e9c28f26194 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:74 
            tracing::debug!("Could not extract {}.{} as string: {}", context, attr, err);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #1924d70b4f3cd973 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:88 
            tracing::debug!("Could not extract {}.{} as i32: {}", context, attr, err);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8af0483662b9f18d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:117 
            tracing::warn!("Could not extract tokenizer path; Rust tokenizer disabled");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #723baa612b498864 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:129 
                tracing::warn!("Could not extract model_config.context_len; defaulting to 0");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #bf2a591fb6265b95 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:172 
        tracing::warn!(
            default = DEFAULT_RESPONSE_CHANNEL_CAPACITY,
            "response_channel_capacity must be positive; using default"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a84c9c9640799415 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:181 
        tracing::warn!(
            default = server::DEFAULT_RESPONSE_TIMEOUT_SECS,
            "response_timeout_secs must be positive; using default"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #169271139d2b0e04 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/lib.rs:246 
                tracing::error!("gRPC server exited with error: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #b0f7f424a570a629 — Environment-variable access.
repo/rust/sglang-grpc/src/server.rs:38 
    match std::env::var("SGLANG_TONIC_PAYLOAD") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #2765b46cbef785d8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/server.rs:41 
                tracing::info!(
                    bytes = n,
                    "Using SGLANG_TONIC_PAYLOAD override for gRPC max message size"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3bb4f2a5fa5769c5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/server.rs:48 
                tracing::warn!(
                    value = %raw,
                    default = DEFAULT_GRPC_MAX_MESSAGE_SIZE,
                    "Ignoring invalid SGLANG_TONIC_PAYLOAD; using default"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f55836b9f2aedc7a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/server.rs:133 
            tracing::warn!(
                rid,
                "Skipping gRPC request abort because no Tokio runtime is available"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #614475806347bbe4 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/server.rs:155 
            tracing::warn!(
                rid,
                "Unary gRPC response received non-terminal Data chunk; expected Finished"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d9108a9d1b93bd16 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/server.rs:665 
            tracing::warn!(
                "Received abort_all over gRPC; this endpoint must only be exposed to trusted clients"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #9cfc34ae16f3c51f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/server.rs:996 
    tracing::info!("gRPC server listening on {}", addr);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f1cb444f4993ab27 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/server.rs:1002 
            tracing::info!("gRPC server shutting down");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #21f2450423cbd613 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/tokenizers.rs:69 
            tracing::info!(
                "Rust tokenizer disabled because tokenizer_mode=slow for {:?}",
                path
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #1a13b9f9215fbeab — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/tokenizers.rs:79 
                tracing::info!(
                    "Rust tokenizer loaded via {} from {:?} (context_len={})",
                    tokenizer.backend_name(),
                    tokenizer_json,
                    context_len
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ab135d11a665b626 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/tokenizers.rs:88 
                tracing::warn!(
                    "Failed to load Rust tokenizer from {:?}: {}. Falling back to Python.",
                    tokenizer_json,
                    e
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #923904cacb035935 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-grpc/src/utils/request_utils.rs:104 
            tracing::warn!("Failed to parse model info JSON: {}", err);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

first-party (rust): sgl-model-gateway

rust first-party
expand_more 53 low-confidence finding(s)
low env_fs production #b9ba656fa6040157 — Environment-variable access.
repo/sgl-model-gateway/build.rs:19 
    let target = std::env::var("TARGET").unwrap_or_else(|_| get_rustc_host().unwrap_or_default());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8fffdec83c6b5a8b — Environment-variable access.
repo/sgl-model-gateway/build.rs:20 
    let profile = std::env::var("PROFILE").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4dfdae78d67e55be — Filesystem access.
repo/sgl-model-gateway/build.rs:62 
    let content = std::fs::read_to_string("Cargo.toml")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d4d5ac7e4175b7c5 — Filesystem access.
repo/sgl-model-gateway/src/config/builder.rs:695 
                let cert = std::fs::read(cert_path).map_err(|e| ConfigError::ValidationFailed {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6e315710a1de64b7 — Filesystem access.
repo/sgl-model-gateway/src/config/builder.rs:701 
                let key = std::fs::read(key_path).map_err(|e| ConfigError::ValidationFailed {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85dc128ff22f47ca — Filesystem access.
repo/sgl-model-gateway/src/config/builder.rs:733 
            let cert = std::fs::read(path).map_err(|e| ConfigError::ValidationFailed {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3295120ebc2198f — Filesystem access.
repo/sgl-model-gateway/src/config/builder.rs:746 
                let cert = std::fs::read(cert_path).map_err(|e| ConfigError::ValidationFailed {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cef8d31191bad8dc — Filesystem access.
repo/sgl-model-gateway/src/config/builder.rs:752 
                let key = std::fs::read(key_path).map_err(|e| ConfigError::ValidationFailed {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7e273ecc4eacd835 — Filesystem access.
repo/sgl-model-gateway/src/config/builder.rs:772 
            let contents = std::fs::read_to_string(mcp_config_path).map_err(|e| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #7344edf51754677e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/circuit_breaker.rs:232 
                tracing::warn!("Success recorded while circuit is open");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4ac9bf3a948c8a1c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:54 
                    tracing::warn!(
                        "Failed to parse URL '{}', defaulting to localhost",
                        metadata_url
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3ca9083a40fd0678 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:63 
            tracing::warn!(
                "Failed to parse URL '{}', defaulting to localhost",
                metadata_url
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3ce53707a39dcfc6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:109 
                    tracing::warn!(
                        worker_url = %self.url,
                        routing_key = %routing_key,
                        "Attempted to decrement routing key counter that is already at 0"
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a2e1b83deb486991 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:117 
                tracing::warn!(
                    worker_url = %self.url,
                    routing_key = %routing_key,
                    "Attempted to decrement non-existent routing key"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #2f7bf719b2df67bd — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:801 
            tracing::warn!(
                worker_url = %self.metadata.url,
                "Attempted to decrement load counter that is already at 0"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #eeb99c8b418eb1e0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:848 
            tracing::debug!(
                "Setting {} models for worker {} via lazy discovery",
                models.len(),
                self.metadata.url
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e70548766f4eef2c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:878 
                        tracing::info!(
                            "Lazily initializing gRPC client ({}) for worker: {}",
                            runtime_str,
                            self.metadata.url
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #df9a2e7391358d55 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:885 
                                tracing::info!(
                                    "Successfully connected gRPC client ({}) for worker: {}",
                                    runtime_str,
                                    self.metadata.url
                                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #624ebf4f28934874 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:893 
                                tracing::error!(
                                    "Failed to connect gRPC client for worker {}: {}",
                                    self.metadata.url,
                                    e
                                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #77614e8270a8ace8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:914 
        tracing::debug!(
            "reset_grpc_client called for {} (no-op with OnceCell)",
            self.metadata.url
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #151dddc36eafabe2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:934 
                tracing::debug!(
                    "gRPC health OK for {}: healthy={}",
                    self.metadata.url,
                    resp.healthy
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #644eab1f6bd497d5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:942 
                tracing::warn!("gRPC health RPC error for {}: {err:?}", self.metadata.url);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #64c29c47012da4b8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:946 
                tracing::warn!("gRPC health timed out for {}", self.metadata.url);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f30f2feefa764d7c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:969 
                    tracing::warn!(
                        "HTTP health check returned non-success status for {}: {}",
                        health_url,
                        status
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4857aed501949d68 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker.rs:978 
                tracing::warn!("HTTP health check failed for {}: {err:?}", health_url);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5f1d5f44c72afe8e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/core/worker_registry.rs:665 
                    tracing::debug!("Registry health checker shutting down");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #c214ebc10639e6b5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/main.rs:1159 
                tracing::warn!("Invalid mesh server address, so mesh server will not be started");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #3f857b16588d5e50 — Environment-variable access.
repo/sgl-model-gateway/src/observability/logging.rs:23 
    match std::env::var("SGLANG_LOG_MS") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #bee02c15d1b00d3e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/policies/cache_aware.rs:511 
            tracing::debug!(
                "Request to {} completed with success={}",
                worker_url,
                success
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f760fd9d3c1ca8ce — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/grpc/common/responses/streaming.rs:799 
                tracing::debug!("Failed to send event (likely client disconnect): {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #69957180e62f9385 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/grpc/harmony/parser.rs:192 
                    tracing::warn!(
                        channel = "commentary",
                        recipient = ?recipient,
                        "Commentary message without valid recipient, treating as reasoning"
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #aa166d64a91f2d04 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/grpc/harmony/processor.rs:263 
            tracing::warn!(
                "Model generated Tool->Assistant message instead of Assistant message. \
                This is a model hallucination bug where it copies tool result format."
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6471428c96ea876b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/grpc/regular/processor.rs:250 
            tracing::debug!(
                "No reasoning parser found for model '{}', skipping reasoning parsing",
                chat_request.model
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #2cc3d9b392d2f8e6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/grpc/regular/processor.rs:257 
            tracing::debug!(
                "No tool parser found for model '{}', skipping tool call parsing",
                chat_request.model
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #df5a3cb798499141 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/http/pd_router.rs:542 
                        tracing::warn!(
                            "Failed to parse decode error body as JSON from {}: {} \
                             (status={}, body preview: {:?})",
                            decode.url(),
                            parse_err,
                            status.as_u16(),
                            preview
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d7492134061fcaad — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/responses/non_streaming.rs:106 
                tracing::error!(
                    url = %url,
                    error = %e,
                    "Failed to forward request to OpenAI"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #31daa7db677bca8d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/responses/streaming.rs:602 
                                tracing::debug!(
                                    "Client disconnected during /responses persistence \
                                    stream from {}; continuing to drain upstream for \
                                    storage",
                                    upstream_url
                                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #11be1b0018ff291f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/responses/streaming.rs:820 
                tracing::info!(
                    "Client disconnected before next tool-call iteration to {}, cancelling",
                    url_clone
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #51c9752549f97dc9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/responses/streaming.rs:853 
                    tracing::error!(
                        "Failed to send /responses tool-interception request to {}: {}",
                        url_clone,
                        e
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #82eaf9d70aab8374 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/responses/streaming.rs:874 
                tracing::error!(
                    "Upstream /responses tool-interception non-success from {}: status={} \
                    body={}",
                    url_clone,
                    status,
                    body
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #9e9cbe45232505c0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/responses/streaming.rs:1025 
                        tracing::error!(
                            "Upstream /responses tool-interception stream error from {}: {}",
                            url_clone,
                            e
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #42b62f497de1fcb6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:222 
                                tracing::info!(
                                    "Model refresh: found {} models from {}",
                                    model_cards.len(),
                                    url
                                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8812e4ebd5030e97 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:234 
                        tracing::warn!("Failed to parse models response: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #7ea5b7d1dd1dcfa1 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:240 
                tracing::debug!(
                    "Model refresh returned non-success status {} from {}",
                    response.status(),
                    url
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f9c7210eeaae5237 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:248 
                tracing::warn!("Failed to fetch models from backend: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #848cadb1adc462d3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:267 
        tracing::debug!(
            "Refreshing models for {} external workers",
            external_workers.len()
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #027de62cc0f9c979 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:308 
        tracing::debug!(
            "No worker found for model '{}', refreshing external worker models",
            model_id
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e7532081831e6a02 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:826 
                                        tracing::error!(
                                            "Failed to deserialize message content: {}",
                                            e
                                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4bd6793439327cf3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:839 
                                        tracing::error!(
                                            "Failed to deserialize function_call: {}",
                                            e
                                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d7865ce126148172 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:847 
                                tracing::debug!(
                                    "Loading function_call_output from DB - content: {}",
                                    serde_json::to_string_pretty(&item.content)
                                        .unwrap_or_else(|_| "failed to serialize".to_string())
                                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e77683c1c4a071f2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:856 
                                        tracing::debug!(
                                            "Successfully deserialized function_call_output"
                                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #12e08859e3bb204a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/routers/openai/router.rs:862 
                                        tracing::error!(
                                            "Failed to deserialize function_call_output: {}",
                                            e
                                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8dbe69ee2a35e81d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/src/server.rs:783 
                tracing::error!("Mesh server failed: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

first-party (rust): sgl-model-gateway/bindings/golang

rust first-party
expand_more 1 low-confidence finding(s)
low telemetry production #336cf37f8c49f8e0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/bindings/golang/src/grpc_converter.rs:573 
                            tracing::warn!("Tool parser error: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

</> Dependencies

apache-tvm-ffi

rust dependency
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #671f02a5dc819089 — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi-macros/src/utils.rs:26 
    if env::var("CARGO_PKG_NAME").unwrap() == "tvm-ffi" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dd8c2c25eef27d7 — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi-sys/build.rs:27 
    let os_env_var = match env::var("CARGO_CFG_TARGET_OS").as_deref() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #baacf04c8f1ec7df — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi-sys/build.rs:37 
    let current_val = env::var(os_env_var).unwrap_or_else(|_| String::new());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6ad096319dd2a27 — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi-sys/build.rs:52 
    let is_rustdoc = env::var("RUSTDOC").is_ok() || env::var("CARGO_CFG_DOC").is_ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9b73d8a69ac3b37 — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi/build.rs:23 
    let is_example_build = env::var("CARGO_FEATURE_EXAMPLE").is_ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e77d7a8a1f025baf — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi/build.rs:28 
    let output_dir = env::var("OUT_DIR").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a7b8718f13899ee — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi/build.rs:42 
    let os_env_var = match env::var("CARGO_CFG_TARGET_OS").as_deref() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c203e4b7a1a6f289 — Environment-variable access.
pkgs/rust/[email protected]/rust/tvm-ffi/build.rs:52 
    let current_val = env::var(os_env_var).unwrap_or_else(|_| String::new());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fastokens

rust dependency
expand_more 13 low-confidence finding(s)
low env_fs tooling reachable #b2990af3e9064b3b — Filesystem access.
pkgs/rust/[email protected]/examples/get_step_kinds.rs:34 
        let json: TokenizerJson = serde_json::from_str(&std::fs::read_to_string(json_path)?)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #b450c166afb5e6f3 — Filesystem access.
pkgs/rust/[email protected]/examples/profile_sample.rs:15 
    let text = std::fs::read_to_string(&json_path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #bf3cb877ad51dad1 — Filesystem access.
pkgs/rust/[email protected]/examples/profile_stages.rs:12 
    let text = std::fs::read_to_string("outputs.txt").context("failed to read outputs.txt")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #f9fc9f73d40bc4f0 — Filesystem access.
pkgs/rust/[email protected]/examples/simple_bench.rs:102 
    let text = std::fs::read_to_string(&json_path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #2dea121bc59c4af7 — Filesystem access.
pkgs/rust/[email protected]/examples/simple_bench.rs:397 
                std::fs::File::create(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c42383c063b5aa30 — Filesystem access.
pkgs/rust/[email protected]/python/src/lib.rs:492 
        let json = std::fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e49b22001017ca4 — Filesystem access.
pkgs/rust/[email protected]/src/lib.rs:154 
        let json: TokenizerJson = serde_json::from_str(&fs::read_to_string(path)?)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ac12f2a20fac5c0 — Filesystem access.
pkgs/rust/[email protected]/src/lib.rs:176 
        let raw = fs::read_to_string(json_path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a0bbcaf68f1dfee — Filesystem access.
pkgs/rust/[email protected]/src/lib.rs:189 
        Ok(fs::read_to_string(json_path)?)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ed295bafccda271 — Filesystem access.
pkgs/rust/[email protected]/src/lib.rs:601 
            let json: TokenizerJson = serde_json::from_str(&fs::read_to_string(json_path).unwrap())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f498420aed036e7 — Filesystem access.
pkgs/rust/[email protected]/src/lib.rs:1219 
                serde_json::from_str(&fs::read_to_string(lb_path).unwrap()).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18ef64dcd88497d3 — Filesystem access.
pkgs/rust/[email protected]/src/lib.rs:1236 
                serde_json::from_str(&fs::read_to_string(sg_path).unwrap()).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd0554b07c9b08c6 — Environment-variable access.
pkgs/rust/[email protected]/src/lib.rs:1367 
        let progress = std::env::var("EXTENDED_PROGRESS").is_ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

granian

rust dependency
expand_more 17 low-confidence finding(s)
low telemetry dependency Excluded from app score #5b2e4f4559cab5fa — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/asgi/conversion.rs:58 
            log::warn!("Unsupported websocket message received {v:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #5a686ea2c7e16e09 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/asgi/io.rs:103 
                    log::info!("ASGI transport error: {err:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #809ba52ac75bbda5 — Filesystem access.
pkgs/rust/[email protected]/src/asgi/io.rs:277 
                        let res = match File::open(&file_path).await {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #c54412ff36974c13 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/asgi/io.rs:288 
                                log::info!("Cannot open file {}", &file_path);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #15c68751b845efad — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/asgi/io.rs:337 
                log::info!("Failed to close websocket with error {err:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #4a91cecd2a16f07d — Filesystem access.
pkgs/rust/[email protected]/src/files.rs:59 
    match File::open(&path).await {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #63c675d05d96d7cb — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/files.rs:85 
            log::info!("Request static file {path} not found");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #9556685642fc4345 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rsgi/conversion.rs:22 
            log::warn!("Unsupported websocket message received {v:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #5bc8d7855d93e152 — Filesystem access.
pkgs/rust/[email protected]/src/rsgi/types.rs:288 
        match File::open(&self.file_path).await {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #368260490248c40e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rsgi/types.rs:298 
                log::info!("Cannot open file {}", &self.file_path);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #bffc38c45ee6d844 — Filesystem access.
pkgs/rust/[email protected]/src/rsgi/types.rs:321 
        match File::open(&self.file_path).await {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #72693cba5ce45cba — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rsgi/types.rs:324 
                    log::error!("Cannot seek to position {} in file {}", self.start, &self.file_path);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #5dca9225793b8ad0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rsgi/types.rs:336 
                log::info!("Cannot open file {}", &self.file_path);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #5c88e4e01c319d8a — Filesystem access.
pkgs/rust/[email protected]/src/tls.rs:67 
            let content = fs::read(filename).expect("cannot load key");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fd086394bb3908d — Filesystem access.
pkgs/rust/[email protected]/src/tls.rs:85 
            fs::File::open(filename).expect("cannot load key"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #0d031413b9f62a27 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/utils.rs:50 
    log::error!("Application callable raised an exception\n{errs}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #1b39d601bdda4eca — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/wsgi/http.rs:36 
    log::error!("WSGI protocol failure");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

libc

rust dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #928a93a4723dfc9a — Environment-variable access.
pkgs/rust/[email protected]/build.rs:63 
    let target_env = env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #302eadba22559c53 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:64 
    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #179ddbec4da51617 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:65 
    let target_ptr_width = env::var("CARGO_CFG_TARGET_POINTER_WIDTH").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b37ee8f792eff5c — Environment-variable access.
pkgs/rust/[email protected]/build.rs:66 
    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cba65fc046ec02a — Environment-variable access.
pkgs/rust/[email protected]/build.rs:75 
    let which_freebsd = if let Ok(version) = env::var("RUST_LIBC_UNSTABLE_FREEBSD_VERSION") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffe04857ce372c48 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:126 
    let linux_time_bits64 = env::var("RUST_LIBC_UNSTABLE_LINUX_TIME_BITS64").is_ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d645722452d6295a — Environment-variable access.
pkgs/rust/[email protected]/build.rs:141 
            env::var("RUST_LIBC_UNSTABLE_GNU_TIME_BITS"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #649f5b5507a9ae06 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:142 
            env::var("RUST_LIBC_UNSTABLE_GNU_FILE_OFFSET_BITS"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #952a319ac094d60f — Environment-variable access.
pkgs/rust/[email protected]/build.rs:191 
    let rustc = env::var_os("RUSTC").expect("Failed to get rustc version: missing RUSTC env");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1d24ad690fd293b — Environment-variable access.
pkgs/rust/[email protected]/build.rs:193 
    let mut cmd = match env::var_os("RUSTC_WRAPPER") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a8be6dccef1848c — Environment-variable access.
pkgs/rust/[email protected]/build.rs:312 
    let version = env::var("WIND_RELEASE_ID").ok()?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #750efbdca9bbe844 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:332 
    match env::var(key) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

llguidance

rust dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #fb0182744ca698fe — Filesystem access.
pkgs/rust/[email protected]/json_schema_test_suite/src/main.rs:101 
    let content = std::fs::read_to_string(path).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1540c7349058492 — Filesystem access.
pkgs/rust/[email protected]/json_schema_test_suite/src/main.rs:380 
        let content = std::fs::read_to_string(&baseline_file)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f63cbf4345f69231 — Filesystem access.
pkgs/rust/[email protected]/json_schema_test_suite/src/main.rs:418 
        std::fs::write(&baseline_file, &json)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54d4b9bbc0086bcd — Environment-variable access.
pkgs/rust/[email protected]/json_stats/src/json_stats.rs:1184 
    if let Ok(jsb_data) = std::env::var("JSB_DATA") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e8957fb4d9f38ec — Filesystem access.
pkgs/rust/[email protected]/json_stats/src/json_stats.rs:1339 
        File::create(filename).unwrap_or_else(|_| panic!("Unable to create file {filename}"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #595d6fc88683b74b — Filesystem access.
pkgs/rust/[email protected]/json_stats/src/json_stats.rs:1347 
        File::create(filename).unwrap_or_else(|_| panic!("Unable to create file {filename}"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc8be6a5786245ce — Filesystem access.
pkgs/rust/[email protected]/json_stats/src/json_stats.rs:1402 
    let mut file = File::open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f000053da42363f0 — Environment-variable access.
pkgs/rust/[email protected]/parser/build.rs:7 
    let crate_dir = env::var("CARGO_MANIFEST_DIR").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f12eaed55c4a1e6 — Filesystem access.
pkgs/rust/[email protected]/parser/build.rs:36 
        let existing = std::fs::read_to_string(&header_path).unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c978ecfea0367a5f — Filesystem access.
pkgs/rust/[email protected]/parser/build.rs:38 
            std::fs::write(&header_path, &filtered).expect("Failed to write llguidance.h");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0267d6d7502a31a — Environment-variable access.
pkgs/rust/[email protected]/parser/build.rs:44 
    if let Ok(out_dir) = env::var("OUT_DIR") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c2d7f749f4b6da99 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/parser/src/json/schema.rs:1269 
        let val = defs.get(key).unwrap();

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #522c0eb5a0ec3cf6 — Filesystem access.
pkgs/rust/[email protected]/sample_parser/src/minimal.rs:138 
    let mut file = File::open(filename).expect("Unable to open file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bde7fc799231f001 — Filesystem access.
pkgs/rust/[email protected]/sample_parser/src/sample_parser.rs:355 
    let mut file = File::open(filename).expect("Unable to open file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #8fa460daf78133be — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/toktrie_hf_tokenizers/src/lib.rs:240 
                            log::warn!("error: {e} for {tok_name:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #15b87cbdf9a3cc31 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/toktrie_hf_tokenizers/src/lib.rs:249 
                log::warn!("missing token: {tok_id}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

openai-harmony

rust dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #923dac80ded5c8c5 — Filesystem access.
pkgs/rust/[email protected]/src/tests.rs:27 
    std::fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e61b1a635289435e — Environment-variable access.
pkgs/rust/[email protected]/src/tiktoken_ext/public_encodings.rs:128 
            if let Ok(base_dir) = std::env::var(TIKTOKEN_ENCODINGS_BASE_VAR) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0ba336350914962 — Filesystem access.
pkgs/rust/[email protected]/src/tiktoken_ext/public_encodings.rs:388 
    let file = std::fs::File::open(path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de1127dc4147ab90 — Environment-variable access.
pkgs/rust/[email protected]/src/tiktoken_ext/public_encodings.rs:469 
    let cache_dir_override = std::env::var("TIKTOKEN_RS_CACHE_DIR").ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3a887a5496c493f — Filesystem access.
pkgs/rust/[email protected]/src/tiktoken_ext/public_encodings.rs:495 
    let file = File::open(file_path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3717f5d60db78830 — Filesystem access.
pkgs/rust/[email protected]/src/tiktoken_ext/public_encodings.rs:517 
    let file = File::create(destination)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openmetrics-parser

rust dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #6b863d6041f74de9 — Filesystem access.
pkgs/rust/[email protected]/src/openmetrics/tests.rs:21 
    let child_str = fs::read_to_string(child_path);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #991d769f93dc4416 — Filesystem access.
pkgs/rust/[email protected]/src/prometheus/tests.rs:11 
            let child_str = fs::read_to_string(&path).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openssl

rust dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #5bd48037ca33b789 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:50 
    if env::var("DEP_OPENSSL_LIBRESSL").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1981e2a869d9141a — Environment-variable access.
pkgs/rust/[email protected]/build.rs:54 
    if env::var("DEP_OPENSSL_BORINGSSL").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #490cb168e236915c — Environment-variable access.
pkgs/rust/[email protected]/build.rs:58 
    if env::var("DEP_OPENSSL_AWSLC").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06ac58718ad9ccee — Environment-variable access.
pkgs/rust/[email protected]/build.rs:62 
    if let Ok(v) = env::var("DEP_OPENSSL_LIBRESSL_VERSION_NUMBER") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15a79bc33322fc84 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:130 
    if let Ok(vars) = env::var("DEP_OPENSSL_CONF") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f3cd7efd4eb0b6a — Environment-variable access.
pkgs/rust/[email protected]/build.rs:136 
    if let Ok(version) = env::var("DEP_OPENSSL_VERSION_NUMBER") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

orjson

rust dependency
expand_more 106 low-confidence finding(s)
low env_fs dependency Excluded from app score #a99d747a53859304 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:7 
    if python_config.is_free_threaded() && std::env::var("ORJSON_BUILD_FREETHREADED").is_err() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #490bde3bca26bc21 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/bytecount-0.6.9/benches/bench.rs:26 
    env::var("COUNTS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1bb42623f91b657 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/bytecount-0.6.9/benches/bench.rs:36 
    if env::var("CI").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #719035c09e954576 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/cc-1.2.61/src/command_helpers.rs:48 
            debug: match std::env::var_os("CC_ENABLE_DEBUG_OUTPUT") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #556e7c632c15a9da — Filesystem access.
pkgs/rust/[email protected]/include/cargo/cc-1.2.61/src/lib.rs:1454 
            let mut f = fs::File::create(&src)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #061a59a914bea3c0 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/cc-1.2.61/src/lib.rs:3897 
        let r = env::var_os(v);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55a547b1e3185b6d — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/cc-1.2.61/src/target/llvm.rs:270 
        let rustc = std::env::var("RUSTC").unwrap_or_else(|_| "rustc".to_string());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #997bc58ed4eef15e — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/cc-1.2.61/src/target/parser.rs:573 
        let rustc = std::env::var("RUSTC").unwrap_or_else(|_| "rustc".to_string());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #139492aa69efa2cb — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/cc-1.2.61/src/utilities.rs:142 
    std::env::var_os(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb3d8e50077a3551 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/find-msvc-tools-0.1.9/src/find_tools.rs:105 
        env::var_os(name).map(Env::Owned)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a44cb01e632c841 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/find-msvc-tools-0.1.9/src/find_tools.rs:269 
    match std::env::var("VisualStudioVersion") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #540248f33867a720 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/find-msvc-tools-0.1.9/src/find_tools.rs:910 
        let mut version_file = if let Ok(f) = File::open(&version_path) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86cc68a40dea35fc — Filesystem access.
pkgs/rust/[email protected]/include/cargo/find-msvc-tools-0.1.9/src/find_tools.rs:948 
            File::open(version_path).ok()?

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da3d1c0a404e5efc — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/concatenated/enabled.rs:282 
        let file = File::open(path).map_err(|e| Error::io(e).path(path))?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64184d3e39bf080a — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/concatenated/enabled.rs:518 
                let var = std::env::var_os(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #362633a22437dd44 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/concatenated/enabled.rs:538 
    let file = File::open(path).map_err(|e| Error::io(e).path(path))?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d11ddd56a86bcd2 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/concatenated/enabled.rs:563 
        let Some(val) = std::env::var_os(ENV) else { return Ok(()) };

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37f9170a24ebce0e — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/zoneinfo/enabled.rs:51 
        if let Some(tzdir) = std::env::var_os("TZDIR") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab6d5f14715ca2ba — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/zoneinfo/enabled.rs:278 
                File::open(path).map_err(|e| Error::io(e).path(path))?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c0ef110ffb5cbee — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/zoneinfo/enabled.rs:631 
        let mut f = match File::open(path) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1626d8597b04790 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/db/zoneinfo/enabled.rs:850 
        let Some(val) = std::env::var_os(ENV) else { return Ok(()) };

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94b6ccf0787c6318 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/system/mod.rs:183 
    let Some(tzenv) = std::env::var_os("TZ") else { return Ok(None) };

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d250cafc9d3d067 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/system/mod.rs:281 
    let data = std::fs::read(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1eaa0fefbd87fc3e — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/tzif.rs:709 
        let Some(val) = std::env::var_os(ENV) else { return Ok(()) };

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c6418895839f96e — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/tzif.rs:714 
            std::fs::read(&val).with_context(|| alloc::format!("{val:?}"))?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4dac80ed5fac168 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/tz/tzif.rs:766 
            let Ok(bytes) = std::fs::read(dent.path()) else { continue };

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0116857839ffc7c — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-0.2.24/src/util/fs.rs:11 
    let file = match File::open(path) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7288b7a586b3109 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/jiff-static-0.2.24/src/lib.rs:107 
        let data = std::fs::read(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62b623b66a80db55 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:68 
    let target_env = env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b24704e8b935b9d6 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:69 
    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a33943dde0440b9 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:70 
    let target_ptr_width = env::var("CARGO_CFG_TARGET_POINTER_WIDTH").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cab8058f7097d795 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:71 
    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #414c9804f0d6cf1a — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:80 
    let which_freebsd = if let Ok(version) = env::var("RUST_LIBC_UNSTABLE_FREEBSD_VERSION") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f109a8b367c12806 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:134 
    let linux_time_bits64 = env::var("RUST_LIBC_UNSTABLE_LINUX_TIME_BITS64").is_ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f30887636f2cd99 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:149 
            env::var("RUST_LIBC_UNSTABLE_GNU_TIME_BITS"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d5a0474bf965d8b — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:150 
            env::var("RUST_LIBC_UNSTABLE_GNU_FILE_OFFSET_BITS"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f3107b52a1bc5ae — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:199 
    let rustc = env::var_os("RUSTC").expect("Failed to get rustc version: missing RUSTC env");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29167d0a9ff71f18 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:201 
    let mut cmd = match env::var_os("RUSTC_WRAPPER") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7e48caa78411378 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:320 
    let version = env::var("WIND_RELEASE_ID").ok()?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3367946d570df658 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/libc-0.2.186/build.rs:340 
    match env::var(key) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3a2acf475d9c2f7 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/no-panic-0.1.36/build.rs:24 
    let rustc = env::var_os("RUSTC").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46b91a49736c4d37 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:32 
    let target = &*env::var("TARGET").expect("TARGET not set");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22a8b30a5fd8dcd9 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:33 
    let target_arch = &*env::var("CARGO_CFG_TARGET_ARCH").expect("CARGO_CFG_TARGET_ARCH not set");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #882b786dc92abfa4 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:34 
    let target_os = &*env::var("CARGO_CFG_TARGET_OS").expect("CARGO_CFG_TARGET_OS not set");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6025e471efc6516 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:39 
            if env::var_os("PORTABLE_ATOMIC_DENY_WARNINGS").is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e69c43d85e5bf856 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:249 
        let sanitize = env::var("CARGO_CFG_SANITIZE").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0878ad30a720f31a — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:281 
                let is_apple = env::var("CARGO_CFG_TARGET_VENDOR").unwrap_or_default() == "apple";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8af0ab6cbe6bc9fa — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:314 
            let is_apple = env::var("CARGO_CFG_TARGET_VENDOR").unwrap_or_default() == "apple";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b97a09a22aceef1a — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:353 
                        if env::var_os("PORTABLE_ATOMIC_DENY_WARNINGS").is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72664863e8353ceb — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:443 
                    pwr8_features = env::var("CARGO_CFG_TARGET_ENDIAN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b20706576cc8538 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:534 
    if let Some(rustflags) = env::var_os("CARGO_ENCODED_RUSTFLAGS") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dba36e3a5d7f8438 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:557 
    let rustflags = env::var_os("CARGO_ENCODED_RUSTFLAGS")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad5e77bf60a40a1b — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:571 
    if env::var_os("RUSTC_STAGE").is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7806a03f2484de3 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/build.rs:577 
    if let Some(rustflags) = env::var_os("CARGO_ENCODED_RUSTFLAGS") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bc8968e550a3c02 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/version.rs:6 
    let rustc = env::var_os("RUSTC")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f180d2ef3f91beae — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/version.rs:7 
    let rustc_wrapper = if env::var_os("CARGO_ENCODED_RUSTFLAGS").is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33bfc590e7e4facb — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/version.rs:8 
        env::var_os("RUSTC_WRAPPER").filter(|v| !v.is_empty())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01c23e07299a4b25 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-1.13.1/version.rs:74 
        let nightly = match env::var_os("RUSTC_BOOTSTRAP") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #705d8a084cbb2717 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-util-0.2.7/build.rs:16 
            if env::var_os("PORTABLE_ATOMIC_DENY_WARNINGS").is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f1f9801097fc54d — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-util-0.2.7/build.rs:76 
            && env::var("CARGO_CFG_TARGET_OS").expect("CARGO_CFG_TARGET_OS not set") == "hermit"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e8a9f57f0677565 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-util-0.2.7/build.rs:91 
        let sanitize = env::var("CARGO_CFG_SANITIZE").unwrap_or_default();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54701877e3f0d075 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-util-0.2.7/build.rs:102 
        let rustc = env::var_os("RUSTC")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6984c542645b7b32 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-util-0.2.7/build.rs:103 
        let rustc_wrapper = if env::var_os("CARGO_ENCODED_RUSTFLAGS").is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #204d8c3d718a8007 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-util-0.2.7/build.rs:104 
            env::var_os("RUSTC_WRAPPER").filter(|v| !v.is_empty())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #940a2d1e50549f2a — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/portable-atomic-util-0.2.7/build.rs:161 
            let nightly = match env::var_os("RUSTC_BOOTSTRAP") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #807b8898a36a175e — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:82 
    } else if let Some(rustc_bootstrap) = env::var_os("RUSTC_BOOTSTRAP") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8dea8a93bfadf864 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:158 
    env::var_os("RUSTC_STAGE").is_none() && do_compile_probe(feature, rustc_bootstrap)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce71e86c91875c60 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:162 
    env::var_os("RUSTC_STAGE").is_some() || do_compile_probe(feature, true)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01904f3f4857e742 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:183 
    let rustc_wrapper = env::var_os("RUSTC_WRAPPER").filter(|wrapper| !wrapper.is_empty());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e034e7773dfab538 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:185 
        env::var_os("RUSTC_WORKSPACE_WRAPPER").filter(|wrapper| !wrapper.is_empty());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #545f903573d444d7 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:208 
    if let Some(target) = env::var_os("TARGET") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df5cd3dabdb9f28f — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:213 
    if let Ok(rustflags) = env::var("CARGO_ENCODED_RUSTFLAGS") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38845dbd66014964 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/proc-macro2-1.0.106/build.rs:260 
    env::var_os(key).unwrap_or_else(|| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #801ba73e8f752f7a — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/build.rs:18 
    let target = Path::new(&env::var_os("OUT_DIR").unwrap()).join(name);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6eabe166366c3ad — Filesystem access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/build.rs:21 
            .to_writer(&mut std::fs::File::create(&target).with_context(|| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5c60cf1e62e99b8 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/build.rs:26 
        std::fs::File::create(&target)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50c9ed74f1421794 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/build.rs:50 
    if std::env::var("CARGO_FEATURE_RESOLVE_CONFIG").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb2c8a179e7ab2d0 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/impl_.rs:54 
    env::var_os(var).map(|os_string| os_string.to_str().unwrap().into())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9702e48e7f7331f5 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/impl_.rs:69 
    env::var_os(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0449a7028eb2fd40 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/impl_.rs:76 
    env::var("TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5129dd4c31a6235b — Filesystem access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/impl_.rs:481 
        let config_file = std::fs::File::open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a9bf7bf6a151c64 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/impl_.rs:1336 
    let mut script = fs::read_to_string(sysconfigdata_path).with_context(|| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce2ba55e2b2d44af — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/import_lib.rs:29 
        env::var_os("OUT_DIR").expect("generate_import_lib() must be called from a build script");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7800791680dfbe4f — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/lib.rs:212 
    env::var_os("TARGET").map(|target| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #095daa17a181e52f — Filesystem access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/lib.rs:338 
            interpreter_config.to_writer(&mut std::fs::File::create(&path).with_context(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02c72f7c9d8df78e — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-build-config-0.28.3/src/lib.rs:395 
        let rustc = env::var_os("RUSTC")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7817c606fcf1c5ea — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/pyo3-ffi-0.28.3/build.rs:44 
    if std::env::var("UNSAFE_PYO3_SKIP_VERSION_CHECK").as_deref() == Ok("1") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6abc7f052be3ff1f — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/quote-1.0.45/build.rs:24 
    let rustc = env::var_os("RUSTC")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05f26dd15c4165d5 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde-1.0.228/build.rs:24 
    let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48c1f15241da12b4 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde-1.0.228/build.rs:25 
    let patch_version = env::var("CARGO_PKG_VERSION_PATCH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db4054961bc16dc2 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/serde-1.0.228/build.rs:27 
    fs::write(out_dir.join("private.rs"), module).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a7ed18bf49c555f — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde-1.0.228/build.rs:61 
    let rustc = env::var_os("RUSTC")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0fb6a559069fb83 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde_core-1.0.228/build.rs:21 
    let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87b7ed753685f6d7 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde_core-1.0.228/build.rs:22 
    let patch_version = env::var("CARGO_PKG_VERSION_PATCH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bcbc7a5cd2738b0 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/serde_core-1.0.228/build.rs:24 
    fs::write(out_dir.join("private.rs"), module).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0cd988cef72dac3 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde_core-1.0.228/build.rs:44 
    let target = env::var("TARGET").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #558ba805ade40674 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde_core-1.0.228/build.rs:105 
    let rustc = env::var_os("RUSTC")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a365841c89843fe6 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde_json-1.0.149/build.rs:10 
    let target_arch = env::var_os("CARGO_CFG_TARGET_ARCH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7053750f6da5fe04 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/serde_json-1.0.149/build.rs:11 
    let target_pointer_width = env::var_os("CARGO_CFG_TARGET_POINTER_WIDTH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4a9148b2d49f5a4 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/syn-2.0.117/benches/file.rs:36 
    let content = fs::read_to_string(FILE).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71f486ed1bb65b25 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/syn-2.0.117/benches/rust.rs:136 
            let content = fs::read_to_string(path).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18a9b7dc44b71cec — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/target-lexicon-0.13.5/build.rs:48 
        env::var_os("OUT_DIR").expect("The OUT_DIR environment variable must be set"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fb09a0131f0d20d — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/target-lexicon-0.13.5/build.rs:50 
    let target = env::var("TARGET").expect("The TARGET environment variable must be set");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #00e523f90519a8e7 — Filesystem access.
pkgs/rust/[email protected]/include/cargo/target-lexicon-0.13.5/build.rs:53 
    let out = File::create(out_dir.join("host.rs")).expect("error creating host.rs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee79f367687e07d4 — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/target-lexicon-0.13.5/build.rs:62 
        let rustc = env::var_os("RUSTC").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01e8e83903253acd — Environment-variable access.
pkgs/rust/[email protected]/include/cargo/zmij-1.0.21/build.rs:34 
    env::var_os(key).unwrap_or_else(|| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

py-spy

rust dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #64e1c2688ae0eb48 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:4 
    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47904ec564bbb751 — Environment-variable access.
pkgs/rust/[email protected]/build.rs:5 
    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7ec8e86d4b56951 — Filesystem access.
pkgs/rust/[email protected]/src/binary_parser.rs:69 
    let file = File::open(filename)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e08e9c811d20a93 — Environment-variable access.
pkgs/rust/[email protected]/src/config.rs:489 
                if std::env::var("PYSPY_ALLOW_FREEBSD_ATTACH").is_err() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #718a96448d2c6826 — Filesystem access.
pkgs/rust/[email protected]/src/coredump.rs:78 
        let mut file = File::open(filename)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27a010f02032e74a — Filesystem access.
pkgs/rust/[email protected]/src/cython.rs:72 
        let contents = std::fs::read_to_string(filename)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e3b424fbb11bfc8 — Filesystem access.
pkgs/rust/[email protected]/src/main.rs:331 
        let mut out_file = std::fs::File::create(&filename)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f60e06a4e8524ee7 — Environment-variable access.
pkgs/rust/[email protected]/src/main.rs:420 
                if let Ok(sudo_uid) = std::env::var("SUDO_UID") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d54a7ee4d1343d51 — Filesystem access.
pkgs/rust/[email protected]/src/main.rs:499 
                if let Ok(cgroups) = std::fs::read_to_string("/proc/self/cgroup") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redis

rust dependency
expand_more 1 low-confidence finding(s)
low env_fs tooling reachable #65426cd43b886e24 — Environment-variable access.
pkgs/rust/[email protected]/examples/geospatial.rs:11 
    let redis_url = match env::var("REDIS_URL") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

rmcp

rust dependency
expand_more 60 low-confidence finding(s)
low telemetry dependency Excluded from app score #09463e00a6e4d279 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/handler/client/progress.rs:29 
                tracing::warn!("Failed to send progress notification: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #ffc447ed7de1b088 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/handler/server.rs:218 
        tracing::info!("client initialized");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #ba3e2fb4c758f8c4 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:422 
            tracing::warn!("trying to set peer info, which is already initialized");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #91749bdd5316bbc8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:560 
        tracing::info!(?peer_info, "Service initialized as client");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #13926b3ac2cadf18 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:562 
        tracing::info!(?peer_info, "Service initialized as server");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #ba71c1d9d544d618 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:673 
                            tracing::info!(id = %param.request_id, reason = param.reason, "cancelled");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #2969d2601541b137 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:695 
                                tracing::error!(%error, "fail to response message");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #c44d4f2f5a12103f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:742 
                    tracing::debug!(%id, ?request, "received request");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #7bdd191ffd6c85a8 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:769 
                                    tracing::debug!(%id, ?result, "response message");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #a69f2e65828c30f6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:773 
                                    tracing::warn!(%id, ?error, "response error");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #b0d99a888f74ab6a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:785 
                    tracing::info!(?notification, "received notification");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #71f7ac83c6a4f4a7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:790 
                                tracing::info!(id = %cancelled.params.request_id, reason = cancelled.params.reason, "cancelled");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #6549fe3800abcec7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:813 
                                tracing::warn!(%error, "Error sending notification");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #e5ea977934c00f4d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:826 
                            tracing::warn!(%id, "Error sending response");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #42d800cb455e1e95 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:834 
                            tracing::warn!(%id, "Error sending response");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #0e5e35d388f93f76 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:842 
            tracing::error!(%e, "fail to close sink");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #e7adbd40aa8b33a6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service.rs:844 
        tracing::info!(?quit_reason, "serve finished");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #ab3714280681f430 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service/client.rs:119 
                    tracing::warn!(?error, "Handle logging before handshake failed.");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #79ecb6eb9cf56608 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/service/client.rs:129 
            _ => tracing::warn!(?message, "Received unexpected message"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #412cfd01f94754b7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/async_rw.rs:124 
                    tracing::error!("Error reading from stream: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #0cc2201c3135c26d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/async_rw.rs:265 
                tracing::debug!(
                    "Failed to parse message {}: {} | Error: {}",
                    context,
                    line_str,
                    e
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #65411eb7b3ae3c3b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/async_rw.rs:414 
                tracing::error!("Error reading from stream: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #70e685c0b7c533c0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/child_process.rs:55 
                    tracing::warn!("Error killing child process: {}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #8812b70b010e9e84 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/client_side_sse.rs:119 
            tracing::warn!(%id, "sse stream error: {error}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #76bed22aaf9bf15f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/client_side_sse.rs:121 
            tracing::warn!("sse stream error: {error}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #9481d6f7c7e80f7c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/client_side_sse.rs:235 
                                    tracing::debug!(last_event_id=%last_id, "failed to deserialize server message: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #6d488112a1b4914f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/client_side_sse.rs:258 
                        tracing::debug!("sse stream terminated");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #df5b8288c6bf48c5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/client_side_sse.rs:271 
                        tracing::debug!("retry sse stream error: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #6743ba25e4382c58 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/client_side_sse.rs:284 
                            tracing::error!("sse stream error: {e}, max retry times reached");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #9176407f6443533e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/reqwest/streamable_http_client.rs:82 
            tracing::debug!("this server doesn't support deleting session");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #5d43ac0236262991 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/reqwest/streamable_http_client.rs:145 
                tracing::error!("unexpected content type: {:?}", content_type);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #691deea8a6380e0d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/common/server_side_http.rs:94 
        tracing::error!("Internal server error when {context}: {error}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #eb9a603b385d57a9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_client.rs:103 
        tracing::warn!(
            uri = %self.uri,
            last_event_id = last_event_id.unwrap_or(""),
            "sse stream error: {error}"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #16e252e61621cfd6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_server.rs:70 
    tracing::debug!(session_id, ?parts, ?message, "new client message");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #c7f605c51e6ee50f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_server.rs:79 
        tracing::error!("send message error");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #6921cc804be75872 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_server.rs:91 
    tracing::info!(%session, ?parts, "sse connection");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #fdae37a2483923d1 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_server.rs:113 
        tracing::warn!("send transport out error");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #e69d7fd93c30c5d5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_server.rs:143 
        tracing::debug!(%session_id, "Closed session and cleaned up resources");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #44e22fdf964a1ff7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_server.rs:249 
            tracing::info!("sse server cancelled");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #c3d54e82a21f44ed — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/sse_server.rs:254 
                    tracing::error!(error = %e, "sse server shutdown with error");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #37c981fe62301ec5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:263 
                tracing::debug!("got response, closing sse stream");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #29f1cb2dbfd78e14 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:350 
                        tracing::info!(session_id = session_id.as_ref(), "delete session success")

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #a1b574d95519dc5a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:353 
                        tracing::info!(
                            session_id = session_id.as_ref(),
                            "server doesn't support delete session"
                        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #901e28fe8f898dcc — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:359 
                        tracing::error!(
                            session_id = session_id.as_ref(),
                            "fail to delete session: {e}"
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #963fbee787291f2c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:421 
                    tracing::debug!("got common stream");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #80f1d0321ab5b81f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:424 
                    tracing::debug!("server doesn't support sse, skip common stream");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #895e5c827a6f1a92 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:428 
                    tracing::error!("fail to get common stream: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #e559ea65ed883925 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_client.rs:528 
                        tracing::warn!(
                            "sse client event stream terminated with error: {:?}",
                            result
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #bebcb6910b9ff222 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/session/local.rs:331 
                    tracing::debug!(http_request_id, "close http request wise channel");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #0775eae4e20e6b66 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/session/local.rs:339 
                tracing::warn!(http_request_id, "http request wise channel not found");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #1fd06d5c0b558799 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/session/local.rs:394 
        tracing::debug!(http_request_id, "establish new request wise channel");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #718600d5232c780e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/session/local.rs:805 
                        tracing::warn!(?error, "failed to send message to http service handler");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #611132fa80d162fe — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/session/local.rs:893 
    tracing::info!(session_id = ?id, "create new session");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #87e9d0893c56bd48 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/tower.rs:356 
                                tracing::error!("Failed to create service: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #0bc8eb3d91a38d13 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/tower.rs:363 
                                tracing::error!("Failed to close session {session_id}: {e}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #753948ed7f88c45e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/streamable_http_server/tower.rs:409 
                            tracing::info!(?message);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #70498d0640b89530 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/worker.rs:122 
                        tracing::debug!("worker quit with reason: {:?}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #177815ee7a374f85 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/worker.rs:125 
                        tracing::error!("worker quit with join error: {:?}", e);

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #a0a6b8957eba363c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/worker.rs:128 
                        tracing::error!("worker quit with fatal: {error}, when {context}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #ea6792c640a2f51b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/transport/worker.rs:132 
                    tracing::debug!("worker quit");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

tracing-appender

rust dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #8fe79de0af374e81 — Filesystem access.
pkgs/rust/[email protected]/src/rolling.rs:718 
            let file = fs::read_to_string(&path).expect("Failed to read file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #e9c63c5274308961 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:962 
        tracing::info!("file 1");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #3b6054e00351e9eb — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:967 
        tracing::info!("file 1");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #961a8fd0f89ca79b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:972 
        tracing::info!("file 2");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #c6f5ff5302a9a9f4 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:977 
        tracing::info!("file 2");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #39e4ea9e5b651e1e — Filesystem access.
pkgs/rust/[email protected]/src/rolling.rs:986 
            let file = fs::read_to_string(&path).expect("Failed to read file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #2eb12c1245e2d2e0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:1044 
        tracing::info!("file 1");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #e35e7f4df798fb25 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:1049 
        tracing::info!("file 1");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #6e7be95cb2b11c10 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:1059 
        tracing::info!("file 2");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #3bb5314a549d2ffd — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:1064 
        tracing::info!("file 2");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #4725e8de00be405a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:1072 
        tracing::info!("file 3");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #a0e0e5560d34de9d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/rolling.rs:1077 
        tracing::info!("file 3");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #b74e10b4531f39b2 — Filesystem access.
pkgs/rust/[email protected]/src/rolling.rs:1087 
            let file = fs::read_to_string(&path).expect("Failed to read file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • cuda-python prod — no sdist (wheels only)
  • decord2 prod — no sdist (wheels only)
  • nvidia-cutlass-dsl prod — no sdist (wheels only)
  • nvidia-mathdx prod — no sdist (wheels only)
  • pillow prod — sdist exceeds byte cap
  • scipy prod — sdist exceeds byte cap
  • sgl-deep-gemm prod — no sdist (wheels only)
  • sglang-kernel prod — no sdist (wheels only)
  • tilelang prod — sdist exceeds byte cap
  • tokenspeed_mla prod — no sdist (wheels only)
  • torch prod — no sdist (wheels only)
  • torchao prod — no sdist (wheels only)
  • torchaudio prod — no sdist (wheels only)
  • torchcodec prod — no sdist (wheels only)
  • torchvision prod — no sdist (wheels only)
  • runai-model-streamer prod — no sdist (wheels only)
  • cache-dit prod — no sdist (wheels only)
  • moviepy prod — sdist exceeds byte cap
  • nvidia-modelopt prod — no sdist (wheels only)
  • opencv-python-headless prod — sdist exceeds byte cap
  • runai_model_streamer prod — no sdist (wheels only)
  • st_attn prod — no sdist (wheels only)
  • vsa prod — no sdist (wheels only)
  • ray prod — no sdist (wheels only)
  • sglang prod — no sdist (wheels only)
  • triton prod — no sdist (wheels only)
  • mooncake-transfer-engine-non-cuda prod — no sdist (wheels only)
  • amd-sglang prod — no python source in sdist
  • petit_kernel prod — no sdist (wheels only)
  • wave-lang prod — no sdist (wheels only)
  • torch_musa prod — pypi 404
  • mthreads-ml-py prod — no sdist (wheels only)
  • flash_attn_3 prod — no sdist (wheels only)
  • github.com/sglang/sglang-go-grpc-sdk prod — proxy 404
  • dynamo-protocols prod — no version pinned
  • dynamo-tokenizers prod — no version pinned
  • dynamo-parsers prod — no version pinned
  • tokio prod — cdn 403
  • axum prod — cdn 403
  • tower prod — cdn 403
  • tower-http prod — cdn 403
  • serde prod — cdn 403
  • reqwest prod — cdn 403
  • serde_json prod — cdn 403
  • hf-hub prod — cdn 403
  • minijinja prod — cdn 403
  • chrono prod — cdn 403
  • minijinja-contrib prod — cdn 403
  • anyhow prod — cdn 403
  • thiserror prod — cdn 403
  • clap prod — cdn 403
  • tracing prod — cdn 403
  • tracing-subscriber prod — cdn 403
  • futures prod — cdn 403
  • bytes prod — cdn 403
  • rand prod — cdn 403
  • tokio-stream prod — cdn 403
  • dashmap prod — cdn 403
  • kube prod — cdn 403
  • tokio-util prod — cdn 403
  • uuid prod — cdn 403
  • k8s-openapi prod — cdn 403
  • rmp-serde prod — cdn 403
  • sha2 prod — cdn 403
  • parking_lot prod — cdn 403
  • url prod — cdn 403
  • zeromq prod — cdn 403
  • pyo3 prod — cdn 403
  • tonic prod — cdn 403
  • prost prod — cdn 403
  • tokenizers prod — cdn 403
  • async-stream prod — cdn 403
  • http-body prod — cdn 403
  • futures-util prod — cdn 403
  • blake3 prod — cdn 403
  • xxhash-rust prod — cdn 403
  • bytemuck prod — cdn 403
  • async-trait prod — cdn 403
  • tracing-log prod — cdn 403
  • opentelemetry prod — cdn 403
  • opentelemetry_sdk prod — cdn 403
  • opentelemetry-otlp prod — cdn 403
  • tracing-opentelemetry prod — cdn 403
  • regex prod — cdn 403
  • memchr prod — cdn 403
  • reasoning-parser prod — invalid crate version
  • openai-protocol prod — invalid crate version
  • tool-parser prod — invalid crate version
  • llm-tokenizer prod — invalid crate version
  • smg-auth prod — invalid crate version
  • wfaas prod — invalid crate version
  • data-connector prod — invalid crate version
  • smg-mcp prod — invalid crate version
  • smg-wasm prod — invalid crate version
  • smg-mesh prod — invalid crate version
  • rustls prod — cdn 403
  • rustls-pemfile prod — cdn 403
  • serde_yaml prod — cdn 403
  • subtle prod — cdn 403
  • num-traits prod — cdn 403
  • num-bigint prod — cdn 403
  • jsonwebtoken prod — cdn 403
  • openai-harmony prod — no version pinned
  • base64 prod — cdn 403
  • smg-grpc-client prod — invalid crate version
  • crdts prod — cdn 403
  • wasmtime prod — cdn 403
  • sgl-model-gateway prod — no version pinned
  • wit-bindgen prod — cdn 403