Close Open Privacy Scan
App Privacy Score
Low risk · 57 finding(s)
Dependency score: 97 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz Application data flows
No high- or medium-confidence application data-flow findings in this scan.
</> First-Party Code
first-party (java): packages/sdk-java/client
java first-partyexpand_more 2 low-confidence finding(s)
private String cwd = System.getProperty("user.dir");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (BufferedReader br = new BufferedReader(new InputStreamReader(Files.newInputStream(file.toPath()), charset), 16384)) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): packages/sdk-java/qwencode
java first-partyexpand_more 1 low-confidence finding(s)
Map<String, String> env = new HashMap<>(System.getenv());
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (npm)
java first-partyexpand_more 3 low-confidence finding(s)
private String cwd = System.getProperty("user.dir");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (BufferedReader br = new BufferedReader(new InputStreamReader(Files.newInputStream(file.toPath()), charset), 16384)) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Map<String, String> env = new HashMap<>(System.getenv());
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
</> Dependencies
ch.qos.logback:logback-classic
java dependencyexpand_more 1 low-confidence finding(s)
return System.getProperty(key);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
com.alibaba.fastjson2:fastjson2
java dependencyexpand_more 23 low-confidence finding(s)
String property = System.getProperty("fastjson2.creator");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String features = System.getProperty("fastjson2.features");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(name);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(name);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_DENY_PROPERTY);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_AUTO_TYPE_ACCEPT);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_AUTO_TYPE_BEFORE_HANDLER);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_AUTO_TYPE_HANDLER);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty("fastjson.parser.safeMode");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
property = System.getProperty("fastjson2.parser.safeMode");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return of(Files.newInputStream(file.toPath()), StandardCharsets.UTF_8);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), StandardCharsets.UTF_8, types);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, consumer);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF16(new InputStreamReader(Files.newInputStream(file.toPath()), charset), consumer);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
new InputStreamReader(Files.newInputStream(file.toPath()), charset), types
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, types);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.newInputStream(file.toPath()),
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, objectClass);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream in = new FileInputStream(file)) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream in = new FileInputStream(file)) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String jmvName = System.getProperty("java.vm.name");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
graal = System.getProperty("org.graalvm.nativeimage.imagecode") != null;
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String javaSpecVer = System.getProperty("java.specification.version");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
commons-io:commons-io
java dependencyexpand_more 19 low-confidence finding(s)
return System.getProperty(property);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream inputStream = new CheckedInputStream(Files.newInputStream(file.toPath()), checksum)) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (Reader input1 = new InputStreamReader(Files.newInputStream(file1.toPath()), charset);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Reader input2 = new InputStreamReader(Files.newInputStream(file2.toPath()), charset)) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream fis = Files.newInputStream(input.toPath())) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty("java.io.tmpdir");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty("user.home");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
inputStream = Files.newInputStream(file.toPath());
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new FileInputStream(file);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.readAllBytes(file.toPath());
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return IOUtils.toString(() -> Files.newInputStream(file.toPath()), Charsets.toCharset(charsetName));
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.readAllLines(file.toPath(), Charsets.toCharset(charset));
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream inputStream1 = Files.newInputStream(nPath1, openOptions);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
InputStream inputStream2 = Files.newInputStream(nPath2, openOptions)) {
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final String property = key != null && !key.isEmpty() ? System.getProperty(key, defaultPath) : defaultPath;
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new String(Files.readAllBytes(path), Charsets.toCharset(charset));
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(path, String.valueOf(charSequence).getBytes(Charsets.toCharset(charset)), openOptions);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
this(Files.newInputStream(Objects.requireNonNull(file, "file")));
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.newInputStream(outputPath);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
org.apache.commons:commons-lang3
java dependencyexpand_more 4 low-confidence finding(s)
final byte[] bytes = Files.readAllBytes(Paths.get(envVarFile));
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return StringUtils.getIfEmpty(System.getProperty(property), defaultIfAbsent);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final String value = System.getenv(name);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return IS_OS_WINDOWS ? System.getenv("COMPUTERNAME") : System.getenv("HOSTNAME");
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
org.slf4j:slf4j-api
java dependencyexpand_more 4 low-confidence finding(s)
String explicitlySpecified = System.getProperty(PROVIDER_PROPERTY_KEY);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String reportStreamStr = System.getProperty(SLF4J_INTERNAL_REPORT_STREAM_KEY);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String verbosityStr = System.getProperty(SLF4J_INTERNAL_VERBOSITY_KEY);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
result = System.getProperty(key);
Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- @agentclientprotocol/sdk prod — dist-only: no readable source
- @qwen-code/qwen-code-core prod — dist-only: no readable source
- @google/genai prod — dist-only: no readable source
- @modelcontextprotocol/sdk prod — dist-only: no readable source
- fdir prod — dist-only: no readable source
- fzf prod — dist-only: no readable source
- https-proxy-agent prod — dist-only: no readable source
- tar prod — dist-only: no readable source
- @qwen-code/sdk prod — dist-only: no readable source
- @qwen-code/channel-base prod — dist-only: no readable source
- @qwen-code/channel-dingtalk prod — registry 404
- @qwen-code/channel-wecom prod — registry 404
- @qwen-code/channel-qqbot prod — registry 404
- @qwen-code/channel-feishu prod — registry 404
- @qwen-code/channel-telegram prod — registry 404
- @qwen-code/channel-weixin prod — registry 404
- @qwen-code/web-templates prod — registry 404
- ink-gradient prod — dist-only: no readable source
- ink-link prod — dist-only: no readable source
- @codemirror/autocomplete prod — dist-only: no readable source
- @codemirror/commands prod — dist-only: no readable source
- @codemirror/language prod — dist-only: no readable source
- @codemirror/state prod — dist-only: no readable source
- @codemirror/view prod — dist-only: no readable source
- codemirror prod — dist-only: no readable source
- mermaid prod — dist-only: no readable source
- shiki prod — dist-only: no readable source
- telegram-markdown-formatter prod — dist-only: no readable source
- @wecom/aibot-node-sdk prod — dist-only: no readable source
- @tencent-connect/qqbot-connector prod — dist-only: no readable source