Close Open Privacy Scan

bolt Snapshot: commit 21b2904
science engine v1.5
schedule 2026-07-14T09:18:07.517879+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 9 finding(s)

Dependency score: 100 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 9 low
First-party packages: 1
Dependency packages: 0
Ecosystem: java

swap_horiz External domains

aapi.github.comapi.github.yourcompany.comapp.posthog.comapp.tabbyml.comatelierbram.github.iobbit.lybrowser-http-intake.logs.datadoghq.eucdn.jsdelivr.netchevrotain.iochriskempson.comclrs.cccode.visualstudio.comcommonmark.orgcscorley.github.iodate-fns.orgdeveloper.mozilla.orgdocs.npmjs.comen.wikipedia.orgethanschoonover.comfb.mefloating-ui.comfonts.googleapis.comgithub.comgitlab.comgitlab.yourcompany.comhart-dev.comi.ibb.coimg.shields.iojslib.k6.iojson-schema.orglegacy.reactjs.orglinks.tabbyml.commarketplace.visualstudio.commomentjs.comnextjs.orgnpmjs.comnpms.ioplayground.app.tabbyml.complugins.jetbrains.composthog.comprosemirror.netradix-ui.comrailscasts.comreact-resizable-panels-au2wmqbbr-brian-vaughns-projects.vercel.appreact-resizable-panels-ca7gk2gh5-brian-vaughns-projects.vercel.appreact-resizable-panels.vercel.appreact-virtualized-auto-sizer.vercel.appreact.devreactjs.orgredux.js.orgregistry.yarnpkg.coms2.googleusercontent.comsentry.iosethawright.comstatic.scarf.shtabby.tabbyml.comtally.sotybenz.comunixunpkg.comuptime.tabbyml.comus.i.posthog.comus.posthog.comuse.typekit.netwww.figma.comwww.framer.comwww.monokai.nlwww.tabbyml.comwww.w3.orgxyarnpkg.comyour-proxy-serverтест

</> First-Party Code

first-party (npm): clients/eclipse

java first-party
expand_more 9 low-confidence finding(s)
low env_fs production #5df0054ffec15743 Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Logger.java:7
	private static String TABBY4ECLIPSE_LOG_DEBUG = System.getenv("TABBY4ECLIPSE_LOG_DEBUG");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d3ac6d2e6cfb405b Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Utils.java:5
		return System.getProperty("os.name").toLowerCase().contains("win");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #80c9983299baf886 Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:12
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ab2b604ace9c5a4b Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:17
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2 = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e93d637d2581ab58 Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:12
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aa5c948d1a6c7a25 Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:17
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #109ffaee17d34fda Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:22
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #06f43e8a88206bf8 Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:38
				String nodePath = nodePathFromPreference.replaceFirst("~", System.getProperty("user.home"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aaba8cbf799bb977 Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:49
				String systemPath = System.getenv("PATH");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @codemirror/language prod — dist-only: no readable source
  • @codemirror/search prod — dist-only: no readable source
  • @codemirror/state prod — dist-only: no readable source
  • @codemirror/view prod — dist-only: no readable source
  • @curvenote/ansi-to-react prod — dist-only: no readable source
  • @urql/core prod — dist-only: no readable source
  • @urql/exchange-auth prod — dist-only: no readable source
  • @urql/exchange-graphcache prod — dist-only: no readable source
  • hast prod — no javascript source
  • mdast prod — no javascript source
  • next prod — tarball exceeds byte cap
  • sonner prod — dist-only: no readable source
  • swr prod — dist-only: no readable source
  • tabby-common prod — cdn 403
  • tabby-download prod — cdn 403
  • tabby-inference prod — cdn 403
  • tantivy prod — cdn 403
  • http-api-bindings prod — cdn 403
  • llama-cpp-server prod — cdn 403
  • tabby-webserver prod — cdn 403
  • hash-ids prod — cdn 403
  • aim-downloader prod — cdn 403
  • tabby-git prod — cdn 403
  • tree-sitter-scala prod — no rust source in crate
  • tree-sitter-python prod — no rust source in crate
  • tree-sitter-java prod — no rust source in crate
  • tree-sitter-kotlin prod — no rust source in crate
  • tree-sitter-rust prod — no rust source in crate
  • tree-sitter-typescript prod — no rust source in crate
  • tree-sitter-ruby prod — no rust source in crate
  • tree-sitter-go prod — no rust source in crate
  • tree-sitter-c prod — no rust source in crate
  • tree-sitter-c-sharp prod — no rust source in crate
  • tree-sitter-cpp prod — no rust source in crate
  • tree-sitter-solidity prod — no rust source in crate
  • tree-sitter-elixir prod — no rust source in crate
  • tree-sitter-lua prod — no rust source in crate
  • tree-sitter-gdscript prod — cdn 403
  • ollama-api-bindings prod — cdn 403
  • which prod — scan budget exceeded
  • ollama-rs prod — scan budget exceeded
  • sqlx prod — scan budget exceeded
  • argon2 prod — scan budget exceeded
  • bincode prod — scan budget exceeded
  • jsonwebtoken prod — scan budget exceeded
  • juniper prod — scan budget exceeded
  • juniper_axum prod — scan budget exceeded
  • juniper_graphql_ws prod — scan budget exceeded
  • ldap3 prod — scan budget exceeded
  • lettre prod — scan budget exceeded
  • pin-project prod — scan budget exceeded
  • querystring prod — scan budget exceeded
  • rust-embed prod — scan budget exceeded
  • tabby-index prod — scan budget exceeded
  • tabby-schema prod — scan budget exceeded
  • tabby-db prod — scan budget exceeded
  • tarpc prod — scan budget exceeded
  • tokio-tungstenite prod — scan budget exceeded
  • tower prod — scan budget exceeded
  • urlencoding prod — scan budget exceeded
  • tabby-crawler prod — scan budget exceeded
  • octocrab prod — scan budget exceeded
  • fs_extra prod — scan budget exceeded
  • gitlab prod — scan budget exceeded
  • cron prod — scan budget exceeded
  • ratelimit prod — scan budget exceeded
  • cached prod — scan budget exceeded
  • openidconnect prod — scan budget exceeded
  • tabby-db-macros prod — scan budget exceeded
  • sql_query_builder prod — scan budget exceeded
  • sqlx-migrate-validate prod — scan budget exceeded
  • quote prod — scan budget exceeded
  • syn prod — scan budget exceeded
  • base64 prod — scan budget exceeded
  • org.eclipse.lsp4j:org.eclipse.lsp4j prod — scan budget exceeded
  • io.github.z4kn4fein:semver prod — scan budget exceeded