Close Open Privacy Scan

link https://github.com/infiniflow/ragflow

bolt Snapshot: commit 4060cd1

science engine v3

schedule 2026-07-11T06:15:31.299053+00:00

App Privacy Score

82 /100

Low privacy risk

Low risk · 618 finding(s)

Dependency score: 52 (Medium risk)

bar_chart Score Breakdown

egress −15

env_fs −3

list Scan Summary

1 high 0 medium 617 low

First-party packages: 2

Dependency packages: 42

Ecosystem: go

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)

high github.com/minio/minio-go/v7 dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

pkgs/go/[email protected]/functional_tests.go:13515 → pkgs/go/[email protected]/functional_tests.go:14162

</> First-Party Code

first-party (go)

go first-party

expand_more 97 low-confidence finding(s)

low env_fs production #1d3a4dc4b23d19f7 — Filesystem access.

repo/internal/agent/component/io/pdf_writer.go:217

	return os.ReadFile(tmpName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e707d7d4f2d6b802 — Filesystem access.

repo/internal/agent/sandbox/local.go:174

	if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d86e735129db1813 — Filesystem access.

repo/internal/agent/sandbox/local.go:274

		if err := os.WriteFile(scriptPath, []byte(BuildPythonWrapper(code, argsJSON)), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #27a5560fefed83ca — Filesystem access.

repo/internal/agent/sandbox/local.go:281

		if err := os.WriteFile(scriptPath, []byte(BuildJavaScriptWrapper(code, argsJSON)), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f167f5788e2817c — Filesystem access.

repo/internal/agent/sandbox/local.go:440

	if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #55cb3bbaf6f9d2bd — Filesystem access.

repo/internal/agent/sandbox/local.go:537

		body, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #47ac21af053e00bd — Filesystem access.

repo/internal/agent/sandbox/ssh.go:177

		if b, err := os.ReadFile(keyPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ee45b5c889cb7a79 — Filesystem access.

repo/internal/cli/cli.go:239

		data, err := os.ReadFile(configFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a5d90257f269ddd2 — Filesystem access.

repo/internal/cli/cli.go:382

	data, err := os.ReadFile("rf.yml")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1fade532e7fdc2f5 — Filesystem access.

repo/internal/cli/cli.go:401

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c46732e6e96ab873 — Filesystem access.

repo/internal/cli/cli.go:690

	if f, err := os.Open(histFile); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3cf9296dbb5d4bb1 — Filesystem access.

repo/internal/cli/cli.go:697

		if f, err := os.Create(histFile); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e2e24e38379e31b8 — Filesystem access.

repo/internal/cli/cli.go:921

	publicKeyPEM, err := os.ReadFile(*publicKeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4de6bc976cc9b3a9 — Filesystem access.

repo/internal/cli/filesystem/skill.go:1591

			content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f978c81533e4786d — Filesystem access.

repo/internal/cli/filesystem/skill_hub/source/local.go:59

	content, err := os.ReadFile(skillMdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ee6cfb23e8b9f518 — Filesystem access.

repo/internal/cli/filesystem/skill_hub/source/local.go:115

		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1b12962f20069520 — Filesystem access.

repo/internal/cli/filesystem/skill_hub/source/local.go:147

	content, err := os.ReadFile(skillMdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #848468456c6f753b — Filesystem access.

repo/internal/cli/filesystem/skill_install.go:288

		if err := os.WriteFile(filePath, content, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7877eaa8db202d00 — Filesystem access.

repo/internal/cli/user_command.go:2042

				imageContent, err := os.ReadFile(image)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c942e76ed87c1e3a — Filesystem access.

repo/internal/cli/user_command.go:2084

		audioContent, err := os.ReadFile(audioFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fedd3db5d5d2d01d — Filesystem access.

repo/internal/cli/user_command.go:2560

	if err := os.WriteFile(localPath, audioBytes, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #74fd16d88fa1999d — Filesystem access.

repo/internal/cli/user_command.go:2586

			if err := os.WriteFile(finalPath, audioBytes, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ec2e01685737f3d1 — Filesystem access.

repo/internal/cli/user_command.go:2765

		fileContent, err = os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #da335a74b9fd69fc — Filesystem access.

repo/internal/cli/user_command.go:2854

			fileContent, err = os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #27027ba2359f8efd — Filesystem access.

repo/internal/cli/user_command.go:3556

	fileContent, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #86d040a1db981b31 — Filesystem access.

repo/internal/cli/user_command.go:3778

	optionsRaw, err := os.ReadFile(optionsFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c52997288189b4bf — Filesystem access.

repo/internal/cli/user_command.go:3799

		fileToChunking, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8b6691f0ed86c1ae — Environment-variable access.

repo/internal/common/environments.go:25

	return os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #273d9602e7ca9ecf — Filesystem access.

repo/internal/common/password.go:202

	keyData, err := os.ReadFile("conf/private.pem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #63ecea599bc2afb9 — Filesystem access.

repo/internal/dao/canvas_template_seed.go:64

		raw, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aef351d8daf650c0 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/char_adapter.go:23

	data, err := os.ReadFile(jsonPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #768881faeb65a563 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:86

		if goTxt, err := os.ReadFile(goTextPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #86ef84e70b11aaab — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:87

			if pyTxt, err := os.ReadFile(pyTextPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a5e05afe1eb48217 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:207

	f, err := os.Create(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #da5c15231466e597 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:380

		goData, _ := os.ReadFile(goPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2dfcf79eb899674d — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:388

		pyData, _ := os.ReadFile(pyPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e691627a2054ede0 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:517

		goData, _ := os.ReadFile(filepath.Join(goDLADir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #dcee39c9be959b55 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:518

		pyData, _ := os.ReadFile(filepath.Join(pyDLADir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #951b22e64cc3a68d — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:588

		goData, _ := os.ReadFile(filepath.Join(goTSRDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #13226ac379d87f3e — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:589

		pyData, _ := os.ReadFile(filepath.Join(pyTSRDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bdb0f5e5eba99123 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/metadata.go:22

		data, err := os.ReadFile(filepath.Join(pyTextDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #138064d592e853df — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/metadata.go:61

		data, err := os.ReadFile(filepath.Join(goTextDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cfb0b03d7d34a9c6 — Filesystem access.

repo/internal/engine/elasticsearch/chunk.go:2405

		data, err = os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f23ada5c46167f50 — Filesystem access.

repo/internal/engine/elasticsearch/client.go:150

	data, err := os.ReadFile(*mappingPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d7ba28b260015097 — Filesystem access.

repo/internal/engine/infinity/chunk.go:75

	schemaData, err := os.ReadFile(*fpMapping)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4ca45fbd0d972fc5 — Filesystem access.

repo/internal/engine/infinity/metadata.go:62

	schemaData, err := os.ReadFile(*fpMapping)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #68a2ccf8ecd63a05 — Filesystem access.

repo/internal/engine/infinity/sql.go:67

	data, err := os.ReadFile(*filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #064ac4c98831cbec — Filesystem access.

repo/internal/entity/models/302ai.go:566

	audioFile, err := os.Open(strings.TrimSpace(*file))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #07c468493335dfce — Filesystem access.

repo/internal/entity/models/cohere.go:531

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ae31e90c400dc111 — Filesystem access.

repo/internal/entity/models/cometapi.go:563

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1152fb5219fdad21 — Filesystem access.

repo/internal/entity/models/deepinfra.go:542

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9c4908aac5b8a446 — Filesystem access.

repo/internal/entity/models/fishaudio.go:94

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8a1fd9370f27fff4 — Filesystem access.

repo/internal/entity/models/groq.go:378

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4df9099198187ce6 — Filesystem access.

repo/internal/entity/models/model.go:261

		data, err = os.ReadFile(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4aa0b2a3a0821caa — Filesystem access.

repo/internal/entity/models/model.go:306

	data, err = os.ReadFile(filepath.Join(findRepoRoot(), "conf", "all_models.json"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8df0c3aa2ff1ba3e — Filesystem access.

repo/internal/entity/models/openai.go:835

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #511966fe2913f92c — Filesystem access.

repo/internal/entity/models/openrouter.go:561

	audio, err := os.ReadFile(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #facd3fedf38b545c — Filesystem access.

repo/internal/entity/models/siliconflow.go:742

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #23d9b0153b74c465 — Filesystem access.

repo/internal/entity/models/togetherai.go:543

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #da28e28a9b528031 — Filesystem access.

repo/internal/entity/models/xai.go:480

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #539b2dc784bdaeeb — Filesystem access.

repo/internal/entity/models/xiaomi.go:472

	audio, err := os.ReadFile(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6d0f657f8988397d — Filesystem access.

repo/internal/entity/models/xinference.go:564

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #685f215d510a1774 — Filesystem access.

repo/internal/entity/models/zhipu-ai.go:689

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e1f91b2bee311da3 — Filesystem access.

repo/internal/handler/tenant.go:358

	data, err := os.ReadFile(req.FilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1999c0b98c9305fc — Filesystem access.

repo/internal/handler/tenant.go:436

	data, err := os.ReadFile(req.FilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0a96368b13f3ffb8 — Filesystem access.

repo/internal/harness/core/evals/evals.go:346

		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4ba24ae86acf4aff — Filesystem access.

repo/internal/harness/core/evals/evals.go:361

		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2a113e432c0e1c2f — Filesystem access.

repo/internal/harness/core/evals/evals.go:505

		data, _ := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1abfb26af3279f23 — Filesystem access.

repo/internal/harness/core/evals/evals.go:518

	if err := os.WriteFile(filepath.Join(dir, "summary.json"), []byte(summary), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #222f9e4c6aea6716 — Filesystem access.

repo/internal/harness/core/evals/evals.go:536

	return os.WriteFile(filepath.Join(dir, "results.csv"), []byte(buf.String()), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ebb8da6ac37ba77c — Filesystem access.

repo/internal/harness/core/middlewares/skill/filesystem_backend.go:19

	data, err := os.ReadFile(b.resolve(path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fee4579248d4213d — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:190

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b034e2a24e89aed2 — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:198

	return os.WriteFile(path, []byte(content), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #09eb3b1e4327f889 — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:202

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #84fccd7ff8ec6bbc — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:211

	return os.WriteFile(path, []byte(content), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #173a6fbdf945dac6 — Filesystem access.

repo/internal/harness/core/prompt_builder.go:105

		content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ccacf96395a2c8f8 — Filesystem access.

repo/internal/harness/core/prompt_builder.go:118

				content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7ee8b49427a8690b — Filesystem access.

repo/internal/harness/core/prompt_builder.go:202

	data, err := os.ReadFile(filepath.Join(root, ".git", "HEAD"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3ba49decd48138ab — Filesystem access.

repo/internal/harness/events/localfile.go:98

	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b638031325adf098 — Filesystem access.

repo/internal/harness/events/localfile.go:154

	f, err := os.OpenFile(fpath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a7ad8509047d746c — Filesystem access.

repo/internal/ingestion/component/pdf_vision_dispatch.go:231

	content, err := os.ReadFile(promptPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #15a69cb4caf07e5b — Filesystem access.

repo/internal/ingestion/task/tool/compare_dataflow_golden.go:257

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b9a9b3e673ab96b2 — Filesystem access.

repo/internal/ingestion/task/tool/compare_dataflow_golden.go:267

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #6929112529fbcad2 — Hardcoded external endpoint. Review what data is sent to this destination.

repo/internal/service/chat_pipeline.go:1770

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, tavilyURL, bytes.NewReader(bodyBytes))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #f9269d07be48348c — Hardcoded external endpoint. Review what data is sent to this destination.

repo/internal/service/connector.go:1198

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, boxOAuthTokenURL, strings.NewReader(form.Encode()))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #9ef89c3d03e258ae — Filesystem access.

repo/internal/service/load_prompt.go:106

	content, err := os.ReadFile(promptPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9fa5f522d9277159 — Filesystem access.

repo/internal/service/metadata_filter.go:110

		content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #657e700d806ca6ed — Filesystem access.

repo/internal/service/nlp/synonym.go:80

	if data, err := os.ReadFile(path); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cd1a735d6412655e — Filesystem access.

repo/internal/service/nlp/term_weight.go:60

	if data, err := os.ReadFile(nerPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1d2dfbd09140ed23 — Filesystem access.

repo/internal/service/nlp/term_weight.go:94

	data, err := os.ReadFile(fnm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cdc8c971312515fd — Filesystem access.

repo/internal/service/nlp/wordnet.go:145

		file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #08376ede5239aeff — Filesystem access.

repo/internal/service/nlp/wordnet.go:172

		file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f94ca67f1b810b69 — Filesystem access.

repo/internal/service/nlp/wordnet.go:333

	file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e5e24c4c8ba4f82b — Filesystem access.

repo/internal/utility/version.go:55

		if data, err = os.ReadFile(versionPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #753fc37859dfefd3 — Filesystem access.

repo/tools/migrate-canvas/main.go:96

	raw, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0b961f6675b558de — Filesystem access.

repo/tools/migrate-canvas/main.go:112

		if err := os.WriteFile(goldenPath, out, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #619c8123760e69bb — Filesystem access.

repo/tools/migrate-canvas/main.go:120

		golden, gErr := os.ReadFile(goldenPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (python)

go first-party

expand_more 97 low-confidence finding(s)

low env_fs production #1d3a4dc4b23d19f7 — Filesystem access.

repo/internal/agent/component/io/pdf_writer.go:217

	return os.ReadFile(tmpName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e707d7d4f2d6b802 — Filesystem access.

repo/internal/agent/sandbox/local.go:174

	if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d86e735129db1813 — Filesystem access.

repo/internal/agent/sandbox/local.go:274

		if err := os.WriteFile(scriptPath, []byte(BuildPythonWrapper(code, argsJSON)), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #27a5560fefed83ca — Filesystem access.

repo/internal/agent/sandbox/local.go:281

		if err := os.WriteFile(scriptPath, []byte(BuildJavaScriptWrapper(code, argsJSON)), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f167f5788e2817c — Filesystem access.

repo/internal/agent/sandbox/local.go:440

	if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #55cb3bbaf6f9d2bd — Filesystem access.

repo/internal/agent/sandbox/local.go:537

		body, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #47ac21af053e00bd — Filesystem access.

repo/internal/agent/sandbox/ssh.go:177

		if b, err := os.ReadFile(keyPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ee45b5c889cb7a79 — Filesystem access.

repo/internal/cli/cli.go:239

		data, err := os.ReadFile(configFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a5d90257f269ddd2 — Filesystem access.

repo/internal/cli/cli.go:382

	data, err := os.ReadFile("rf.yml")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1fade532e7fdc2f5 — Filesystem access.

repo/internal/cli/cli.go:401

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c46732e6e96ab873 — Filesystem access.

repo/internal/cli/cli.go:690

	if f, err := os.Open(histFile); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3cf9296dbb5d4bb1 — Filesystem access.

repo/internal/cli/cli.go:697

		if f, err := os.Create(histFile); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e2e24e38379e31b8 — Filesystem access.

repo/internal/cli/cli.go:921

	publicKeyPEM, err := os.ReadFile(*publicKeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4de6bc976cc9b3a9 — Filesystem access.

repo/internal/cli/filesystem/skill.go:1591

			content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f978c81533e4786d — Filesystem access.

repo/internal/cli/filesystem/skill_hub/source/local.go:59

	content, err := os.ReadFile(skillMdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ee6cfb23e8b9f518 — Filesystem access.

repo/internal/cli/filesystem/skill_hub/source/local.go:115

		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1b12962f20069520 — Filesystem access.

repo/internal/cli/filesystem/skill_hub/source/local.go:147

	content, err := os.ReadFile(skillMdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #848468456c6f753b — Filesystem access.

repo/internal/cli/filesystem/skill_install.go:288

		if err := os.WriteFile(filePath, content, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7877eaa8db202d00 — Filesystem access.

repo/internal/cli/user_command.go:2042

				imageContent, err := os.ReadFile(image)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c942e76ed87c1e3a — Filesystem access.

repo/internal/cli/user_command.go:2084

		audioContent, err := os.ReadFile(audioFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fedd3db5d5d2d01d — Filesystem access.

repo/internal/cli/user_command.go:2560

	if err := os.WriteFile(localPath, audioBytes, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #74fd16d88fa1999d — Filesystem access.

repo/internal/cli/user_command.go:2586

			if err := os.WriteFile(finalPath, audioBytes, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ec2e01685737f3d1 — Filesystem access.

repo/internal/cli/user_command.go:2765

		fileContent, err = os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #da335a74b9fd69fc — Filesystem access.

repo/internal/cli/user_command.go:2854

			fileContent, err = os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #27027ba2359f8efd — Filesystem access.

repo/internal/cli/user_command.go:3556

	fileContent, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #86d040a1db981b31 — Filesystem access.

repo/internal/cli/user_command.go:3778

	optionsRaw, err := os.ReadFile(optionsFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c52997288189b4bf — Filesystem access.

repo/internal/cli/user_command.go:3799

		fileToChunking, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8b6691f0ed86c1ae — Environment-variable access.

repo/internal/common/environments.go:25

	return os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #273d9602e7ca9ecf — Filesystem access.

repo/internal/common/password.go:202

	keyData, err := os.ReadFile("conf/private.pem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #63ecea599bc2afb9 — Filesystem access.

repo/internal/dao/canvas_template_seed.go:64

		raw, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aef351d8daf650c0 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/char_adapter.go:23

	data, err := os.ReadFile(jsonPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #768881faeb65a563 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:86

		if goTxt, err := os.ReadFile(goTextPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #86ef84e70b11aaab — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:87

			if pyTxt, err := os.ReadFile(pyTextPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a5e05afe1eb48217 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:207

	f, err := os.Create(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #da5c15231466e597 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:380

		goData, _ := os.ReadFile(goPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2dfcf79eb899674d — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:388

		pyData, _ := os.ReadFile(pyPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e691627a2054ede0 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:517

		goData, _ := os.ReadFile(filepath.Join(goDLADir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #dcee39c9be959b55 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:518

		pyData, _ := os.ReadFile(filepath.Join(pyDLADir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #951b22e64cc3a68d — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:588

		goData, _ := os.ReadFile(filepath.Join(goTSRDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #13226ac379d87f3e — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/compare.go:589

		pyData, _ := os.ReadFile(filepath.Join(pyTSRDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bdb0f5e5eba99123 — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/metadata.go:22

		data, err := os.ReadFile(filepath.Join(pyTextDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #138064d592e853df — Filesystem access.

repo/internal/deepdoc/parser/pdf/tool/metadata.go:61

		data, err := os.ReadFile(filepath.Join(goTextDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cfb0b03d7d34a9c6 — Filesystem access.

repo/internal/engine/elasticsearch/chunk.go:2405

		data, err = os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f23ada5c46167f50 — Filesystem access.

repo/internal/engine/elasticsearch/client.go:150

	data, err := os.ReadFile(*mappingPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d7ba28b260015097 — Filesystem access.

repo/internal/engine/infinity/chunk.go:75

	schemaData, err := os.ReadFile(*fpMapping)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4ca45fbd0d972fc5 — Filesystem access.

repo/internal/engine/infinity/metadata.go:62

	schemaData, err := os.ReadFile(*fpMapping)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #68a2ccf8ecd63a05 — Filesystem access.

repo/internal/engine/infinity/sql.go:67

	data, err := os.ReadFile(*filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #064ac4c98831cbec — Filesystem access.

repo/internal/entity/models/302ai.go:566

	audioFile, err := os.Open(strings.TrimSpace(*file))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #07c468493335dfce — Filesystem access.

repo/internal/entity/models/cohere.go:531

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ae31e90c400dc111 — Filesystem access.

repo/internal/entity/models/cometapi.go:563

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1152fb5219fdad21 — Filesystem access.

repo/internal/entity/models/deepinfra.go:542

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9c4908aac5b8a446 — Filesystem access.

repo/internal/entity/models/fishaudio.go:94

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8a1fd9370f27fff4 — Filesystem access.

repo/internal/entity/models/groq.go:378

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4df9099198187ce6 — Filesystem access.

repo/internal/entity/models/model.go:261

		data, err = os.ReadFile(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4aa0b2a3a0821caa — Filesystem access.

repo/internal/entity/models/model.go:306

	data, err = os.ReadFile(filepath.Join(findRepoRoot(), "conf", "all_models.json"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8df0c3aa2ff1ba3e — Filesystem access.

repo/internal/entity/models/openai.go:835

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #511966fe2913f92c — Filesystem access.

repo/internal/entity/models/openrouter.go:561

	audio, err := os.ReadFile(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #facd3fedf38b545c — Filesystem access.

repo/internal/entity/models/siliconflow.go:742

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #23d9b0153b74c465 — Filesystem access.

repo/internal/entity/models/togetherai.go:543

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #da28e28a9b528031 — Filesystem access.

repo/internal/entity/models/xai.go:480

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #539b2dc784bdaeeb — Filesystem access.

repo/internal/entity/models/xiaomi.go:472

	audio, err := os.ReadFile(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6d0f657f8988397d — Filesystem access.

repo/internal/entity/models/xinference.go:564

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #685f215d510a1774 — Filesystem access.

repo/internal/entity/models/zhipu-ai.go:689

	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e1f91b2bee311da3 — Filesystem access.

repo/internal/handler/tenant.go:358

	data, err := os.ReadFile(req.FilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1999c0b98c9305fc — Filesystem access.

repo/internal/handler/tenant.go:436

	data, err := os.ReadFile(req.FilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0a96368b13f3ffb8 — Filesystem access.

repo/internal/harness/core/evals/evals.go:346

		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4ba24ae86acf4aff — Filesystem access.

repo/internal/harness/core/evals/evals.go:361

		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2a113e432c0e1c2f — Filesystem access.

repo/internal/harness/core/evals/evals.go:505

		data, _ := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1abfb26af3279f23 — Filesystem access.

repo/internal/harness/core/evals/evals.go:518

	if err := os.WriteFile(filepath.Join(dir, "summary.json"), []byte(summary), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #222f9e4c6aea6716 — Filesystem access.

repo/internal/harness/core/evals/evals.go:536

	return os.WriteFile(filepath.Join(dir, "results.csv"), []byte(buf.String()), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ebb8da6ac37ba77c — Filesystem access.

repo/internal/harness/core/middlewares/skill/filesystem_backend.go:19

	data, err := os.ReadFile(b.resolve(path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fee4579248d4213d — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:190

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b034e2a24e89aed2 — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:198

	return os.WriteFile(path, []byte(content), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #09eb3b1e4327f889 — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:202

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #84fccd7ff8ec6bbc — Filesystem access.

repo/internal/harness/core/prebuilt/coding/coding.go:211

	return os.WriteFile(path, []byte(content), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #173a6fbdf945dac6 — Filesystem access.

repo/internal/harness/core/prompt_builder.go:105

		content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ccacf96395a2c8f8 — Filesystem access.

repo/internal/harness/core/prompt_builder.go:118

				content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7ee8b49427a8690b — Filesystem access.

repo/internal/harness/core/prompt_builder.go:202

	data, err := os.ReadFile(filepath.Join(root, ".git", "HEAD"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3ba49decd48138ab — Filesystem access.

repo/internal/harness/events/localfile.go:98

	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b638031325adf098 — Filesystem access.

repo/internal/harness/events/localfile.go:154

	f, err := os.OpenFile(fpath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a7ad8509047d746c — Filesystem access.

repo/internal/ingestion/component/pdf_vision_dispatch.go:231

	content, err := os.ReadFile(promptPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #15a69cb4caf07e5b — Filesystem access.

repo/internal/ingestion/task/tool/compare_dataflow_golden.go:257

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b9a9b3e673ab96b2 — Filesystem access.

repo/internal/ingestion/task/tool/compare_dataflow_golden.go:267

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #6929112529fbcad2 — Hardcoded external endpoint. Review what data is sent to this destination.

repo/internal/service/chat_pipeline.go:1770

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, tavilyURL, bytes.NewReader(bodyBytes))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #f9269d07be48348c — Hardcoded external endpoint. Review what data is sent to this destination.

repo/internal/service/connector.go:1198

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, boxOAuthTokenURL, strings.NewReader(form.Encode()))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #9ef89c3d03e258ae — Filesystem access.

repo/internal/service/load_prompt.go:106

	content, err := os.ReadFile(promptPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9fa5f522d9277159 — Filesystem access.

repo/internal/service/metadata_filter.go:110

		content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #657e700d806ca6ed — Filesystem access.

repo/internal/service/nlp/synonym.go:80

	if data, err := os.ReadFile(path); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cd1a735d6412655e — Filesystem access.

repo/internal/service/nlp/term_weight.go:60

	if data, err := os.ReadFile(nerPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1d2dfbd09140ed23 — Filesystem access.

repo/internal/service/nlp/term_weight.go:94

	data, err := os.ReadFile(fnm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cdc8c971312515fd — Filesystem access.

repo/internal/service/nlp/wordnet.go:145

		file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #08376ede5239aeff — Filesystem access.

repo/internal/service/nlp/wordnet.go:172

		file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f94ca67f1b810b69 — Filesystem access.

repo/internal/service/nlp/wordnet.go:333

	file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e5e24c4c8ba4f82b — Filesystem access.

repo/internal/utility/version.go:55

		if data, err = os.ReadFile(versionPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #753fc37859dfefd3 — Filesystem access.

repo/tools/migrate-canvas/main.go:96

	raw, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0b961f6675b558de — Filesystem access.

repo/tools/migrate-canvas/main.go:112

		if err := os.WriteFile(goldenPath, out, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #619c8123760e69bb — Filesystem access.

repo/tools/migrate-canvas/main.go:120

		golden, gErr := os.ReadFile(goldenPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

github.com/minio/minio-go/v7

go dependency

high pii_flow dependency Excluded from app score #0891a03719279a3a — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

pkgs/go/[email protected]/functional_tests.go:14162 · flow /tmp/closeopen-ygf0y_ym/pkgs/go/[email protected]/functional_tests.go:13515 → /tmp/closeopen-ygf0y_ym/pkgs/go/[email protected]/functional_tests.go:14162

			req, err := http.NewRequestWithContext(ctx, test.method, test.url, nil)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

expand_more 71 low-confidence finding(s)

low env_fs dependency Excluded from app score #f41a68eafff6dec2 — Filesystem access.

pkgs/go/[email protected]/api-get-object-file.go:75

	filePart, err := os.OpenFile(filePartPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67b749a8656c8332 — Filesystem access.

pkgs/go/[email protected]/api-put-object-file-context.go:40

	fileReader, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6244811493c1c09 — Filesystem access.

pkgs/go/[email protected]/api-putobject-snowball.go:138

			f, err := os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b7be9224d325407 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:80

	transport, err = minio.DefaultTransport(mustParseBool(os.Getenv(enableHTTPS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4286e8445c532156 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:86

	if mustParseBool(os.Getenv(enableHTTPS)) && mustParseBool(os.Getenv(skipCERTValidation)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4102cdf8a2a99b2 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:266

	return os.Getenv("RUN_ON_FAIL") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #361fc6768ee8becb — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:272

	if os.Getenv(serverEndpoint) == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73cde3e411edacbf — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:280

var mintDataDir = os.Getenv("MINT_DATA_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42f740b53c4e7cb1 — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:338

	reader, _ := os.Open(getMintDataDirFilePath(fileName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cbd9d55e4b3282d — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:342

		reader, _ = os.Open(getMintDataDirFilePath(fileName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21726898ecf7f8aa — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:384

	return os.Getenv("MINT_MODE") == "full"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6da35cb99bc60510 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:407

		creds = credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f7000971ea76778 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:409

		creds = credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2125bdf08544d527 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:414

		Secure:          mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbf786bbffeef737 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:417

	client, err := minio.New(os.Getenv(serverEndpoint), opts)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e9ca46373e46cf9 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:2107

		if os.Getenv("MINT_NO_FULL_OBJECT") != "" && test.cs.FullObjectRequested() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0807a97ec36ba653 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:2293

		if os.Getenv("MINT_NO_FULL_OBJECT") != "" && test.cs.FullObjectRequested() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f2405f0b8775135 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:2508

		if os.Getenv("MINT_NO_FULL_OBJECT") != "" && test.cs.FullObjectRequested() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #990e714123c3b68f — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:3017

		if mustParseBool(os.Getenv(enableHTTPS)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #112cf0e323fa055c — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:4576

	srcFile, err := os.Open(fName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a417766f0dd6ebb — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:4583

	tmpFile, err := os.Create(fName + ".gtar")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7175e105704b50f — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:5606

	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b854755945f3138a — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:5656

	if mustParseBool(os.Getenv(enableHTTPS)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4159231cb0f1ace — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:5662

	expectedLocation := scheme + os.Getenv(serverEndpoint) + "/" + bucketName + "/" + objectName

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2140bdcdc0fce61a — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:5663

	expectedLocationBucketDNS := scheme + bucketName + "." + os.Getenv(serverEndpoint) + "/" + objectName

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05da868ef1cad87d — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:5799

	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #321206e3f6dcec66 — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:5956

	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c16975c9dad6675d — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:7025

		file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1c6262536a2d8b8 — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:7227

		file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #125a9631b1a61813 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:7282

	if os.Getenv("NOTIFY_BUCKET") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0fa34b78fb80606 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:7283

		os.Getenv("NOTIFY_SERVICE") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #deb57562c9520d5c — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:7284

		os.Getenv("NOTIFY_REGION") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06469b4f92962a66 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:7285

		os.Getenv("NOTIFY_ACCOUNTID") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a849f9872420309a — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:7286

		os.Getenv("NOTIFY_RESOURCE") == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa62b853575181c2 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:7297

	bucketName := os.Getenv("NOTIFY_BUCKET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2db914dc0b501fc0 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:7300

	topicArn := notification.NewArn("aws", os.Getenv("NOTIFY_SERVICE"), os.Getenv("NOTIFY_REGION"), os.Getenv("NOTIFY_ACCOUNTID"), os.Getenv("NOTIFY_RESOURCE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #daeb4c68c4b6c6af — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:7395

	file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3b5eceddd425887 — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:8141

		tempfile, err = os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca5826c374da295f — Filesystem access.

pkgs/go/[email protected]/functional_tests.go:12357

	file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d83bd290e96675a — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:13098

	if os.Getenv(serverEndpoint) != "s3.amazonaws.com" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83de8331db8a63f0 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:13515

	bucketName := os.Getenv("MINIO_GO_TEST_BUCKET_CORS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fc01e3727510549 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:14783

	tls := mustParseBool(os.Getenv(enableHTTPS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6972e52fdf45ec77 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:14784

	kms := mustParseBool(os.Getenv(enableKMS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f703e126c566f260 — Environment-variable access.

pkgs/go/[email protected]/functional_tests.go:14785

	if os.Getenv(enableKMS) == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #642fd979b53409e7 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_aws.go:43

	id := os.Getenv("AWS_ACCESS_KEY_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f292f9dbe7538b47 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_aws.go:45

		id = os.Getenv("AWS_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2105c7dff2eeb540 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_aws.go:48

	secret := os.Getenv("AWS_SECRET_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a18bf0747c8c8e79 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_aws.go:50

		secret = os.Getenv("AWS_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19706d18f9a1327e — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_aws.go:62

		SessionToken:    os.Getenv("AWS_SESSION_TOKEN"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a57054971075dd7 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_minio.go:44

	id := os.Getenv("MINIO_ROOT_USER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e448758b1c70c725 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_minio.go:45

	secret := os.Getenv("MINIO_ROOT_PASSWORD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3ab8b73c07b21bf — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_minio.go:49

		id = os.Getenv("MINIO_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95f932c57ef402ab — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/env_minio.go:50

		secret = os.Getenv("MINIO_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #828ff860cf718e24 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/file_aws_credentials.go:76

		p.Filename = os.Getenv("AWS_SHARED_CREDENTIALS_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #696b39d17151e636 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/file_aws_credentials.go:86

		p.Profile = os.Getenv("AWS_PROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b228e04825b9dff5 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:60

		if value, ok := os.LookupEnv("MINIO_SHARED_CREDENTIALS_FILE"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0032eeda1b4f3af8 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:75

		p.Alias = os.Getenv("MINIO_ALIAS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e068ecc6c96478b — Filesystem access.

pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:132

	configBytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f9b220a4ac4dbab — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:103

	token := os.Getenv("AWS_CONTAINER_AUTHORIZATION_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cbaeabbbf46b2178 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:108

	tokenFile := os.Getenv("AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f7ffac2367b46ce — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:113

	relativeURI := os.Getenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #605a72af68b7eeeb — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:118

	fullURI := os.Getenv("AWS_CONTAINER_CREDENTIALS_FULL_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a35f97d9432f27b — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:123

	identityFile := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cce35f3a171a49fc — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:128

	roleArn := os.Getenv("AWS_ROLE_ARN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db142d52c2ca47d1 — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:133

	roleSessionName := os.Getenv("AWS_ROLE_SESSION_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a3bf56d2a4e5d2b — Environment-variable access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:138

	region := os.Getenv("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31a93e73d5d151f8 — Filesystem access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:174

				token, err := os.ReadFile(identityFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2737f61583351a40 — Filesystem access.

pkgs/go/[email protected]/pkg/credentials/iam_aws.go:335

		bytes, err := os.ReadFile(tokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #466598eeb2d7af24 — Filesystem access.

pkgs/go/[email protected]/pkg/credentials/sts_web_identity.go:121

		token, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf7839f11760305f — Environment-variable access.

pkgs/go/[email protected]/transport.go:72

		if f := os.Getenv("SSL_CERT_FILE"); f != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0711f34234f310e — Filesystem access.

pkgs/go/[email protected]/transport.go:74

			data, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cloud.google.com/go/storage

go dependency

expand_more 13 low-confidence finding(s)

low env_fs dependency Excluded from app score #7cb085bad3019cef — Environment-variable access.

pkgs/go/[email protected]/grpc_client.go:95

	if host := os.Getenv("STORAGE_EMULATOR_HOST_GRPC"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a92611220fbcb9c8 — Environment-variable access.

pkgs/go/[email protected]/grpc_client.go:112

		if disableBoundToken, _ := strconv.ParseBool(os.Getenv("STORAGE_DISABLE_DIRECTPATH_BOUND_TOKEN")); !disableBoundToken {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1064423887876eb1 — Environment-variable access.

pkgs/go/[email protected]/grpc_dp_diag.go:53

	if strings.EqualFold(os.Getenv(directPathDisableEnvVar), "true") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53c7bec1cc4448fd — Environment-variable access.

pkgs/go/[email protected]/http_client.go:78

	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #caec3bb931cddb30 — Environment-variable access.

pkgs/go/[email protected]/invoke.go:52

		return os.Getenv("GOOGLE_SDK_GO_TRACING_COOKIE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef217e7b90b4b9ca — Environment-variable access.

pkgs/go/[email protected]/option.go:52

	increaseRate := os.Getenv(dynamicReadReqIncreaseRateEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8242b0c78736d148 — Environment-variable access.

pkgs/go/[email protected]/option.go:67

	initialTimeout := os.Getenv(dynamicReadReqInitialTimeoutEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2150485134251459 — Environment-variable access.

pkgs/go/[email protected]/storage.go:162

	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d4a93dcc3a9341a — Environment-variable access.

pkgs/go/[email protected]/storage.go:382

	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f511d55dde892ec — Environment-variable access.

pkgs/go/[email protected]/storage.go:394

	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83bc8e9a2a40ce9c — Environment-variable access.

pkgs/go/[email protected]/trace.go:65

	return os.Getenv(storageOtelTracingDevVar) == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f331400e6ae2bb88 — Environment-variable access.

pkgs/go/[email protected]/trace.go:69

	return os.Getenv(storageBucketMetadataDisabledVar) != "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c333fe748254f9f — Filesystem access.

pkgs/go/[email protected]/transfermanager/downloader.go:221

		f, fErr := os.Create(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/alibabacloud-go/darabonba-openapi/v2

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #c0a56b01c0487726 — Environment-variable access.

pkgs/go/[email protected]/client/client.go:115

		client.UserAgent = dara.String(os.Getenv("ALIBABA_CLOUD_USER_AGENT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/alicebob/miniredis/v2

go dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #5aba86da8e88a1b2 — Environment-variable access.

pkgs/go/[email protected]/integration/ephemeral.go:73

	os.Setenv("PATH", fmt.Sprintf("%s:%s", absSrc, os.Getenv("PATH")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #773cc3cf9f2a555f — Environment-variable access.

pkgs/go/[email protected]/integration/test.go:20

	if os.Getenv("INT") == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8adee3ce3f8a14c6 — Filesystem access.

pkgs/go/[email protected]/integration/tls.go:17

	rootca, err := ioutil.ReadFile("../testdata/client.crt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ff8bfa28528bf14 — Filesystem access.

pkgs/go/[email protected]/integration/tls.go:38

	rootca, err := ioutil.ReadFile("../testdata/server.crt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2

go dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #3b1cd64dac4c779b — Filesystem access.

pkgs/go/[email protected]/aws/generate.go:29

	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90ff8779e6b35f90 — Filesystem access.

pkgs/go/[email protected]/aws/logging_generate.go:85

	file, err := os.Create("logging.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da7bc3e7033c4125 — Environment-variable access.

pkgs/go/[email protected]/aws/middleware/recursion_detection.go:40

	_, hasLambdaEnv := os.LookupEnv(envAwsLambdaFunctionName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #675754583a8fb115 — Environment-variable access.

pkgs/go/[email protected]/aws/middleware/recursion_detection.go:41

	xAmznTraceID, hasTraceID := os.LookupEnv(envAmznTraceID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1869b8ea14f49e28 — Environment-variable access.

pkgs/go/[email protected]/aws/middleware/user_agent.go:208

	if ev := os.Getenv(execEnvVar); len(ev) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #436bb1f6f2331681 — Environment-variable access.

pkgs/go/[email protected]/internal/awstesting/util.go:106

	originalEnv := os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c7e8fca25524ca3 — Environment-variable access.

pkgs/go/[email protected]/internal/awstesting/util.go:150

		if val, ok := os.LookupEnv(env); ok && len(val) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb06ffb58b205b13 — Filesystem access.

pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:102

	modelFile, err := os.Open(modelFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cca53455aa3661a8 — Filesystem access.

pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:113

	file, err := os.Create(outputFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/config

go dependency

expand_more 37 low-confidence finding(s)

low env_fs dependency Excluded from app score #f2ee57a72401f742 — Filesystem access.

pkgs/go/[email protected]/codegen/main.go:94

	file, err := os.OpenFile(config.OutputPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0744)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd0602d8c2c4156c — Environment-variable access.

pkgs/go/[email protected]/config.go:228

	if os.Getenv(awsProfileEnv) != "" || options.SharedConfigProfile != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee4a16e814ef2e6f — Environment-variable access.

pkgs/go/[email protected]/defaultsmode.go:43

		EnvironmentIdentifier:     aws.ExecutionEnvironmentID(os.Getenv(execEnvVar)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9190d74b33d4ebfb — Environment-variable access.

pkgs/go/[email protected]/env_config.go:331

		creds.AccountID = os.Getenv(awsAccountIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79962a07d043bf36 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:332

		creds.SessionToken = os.Getenv(awsSessionTokenEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7358c06982f768d8 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:336

	cfg.ContainerCredentialsEndpoint = os.Getenv(awsContainerCredentialsFullURIEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9473766a70953fa9 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:337

	cfg.ContainerCredentialsRelativePath = os.Getenv(awsContainerCredentialsRelativeURIEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #822b68afa6d0a036 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:338

	cfg.ContainerAuthorizationToken = os.Getenv(awsContainerAuthorizationTokenEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58b29d486a55cee3 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:343

	cfg.SharedCredentialsFile = os.Getenv(awsSharedCredentialsFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d16e381e53311dd3 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:344

	cfg.SharedConfigFile = os.Getenv(awsConfigFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59549eafa2deeb02 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:346

	cfg.CustomCABundle = os.Getenv(awsCABundleEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d75931edc154836 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:348

	cfg.WebIdentityTokenFilePath = os.Getenv(awsWebIdentityTokenFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13db2611506d25c9 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:350

	cfg.RoleARN = os.Getenv(awsRoleARNEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84bf662c1050cea3 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:351

	cfg.RoleSessionName = os.Getenv(awsRoleSessionNameEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37254798c0c859b9 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:353

	cfg.AppID = os.Getenv(awsSdkUaAppIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43f60ce2eecd5a1d — Environment-variable access.

pkgs/go/[email protected]/env_config.go:374

	cfg.EC2IMDSEndpoint = os.Getenv(awsEc2MetadataServiceEndpointEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de2c5b82e8791053 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:423

	cfg.AuthSchemePreference = toAuthSchemePreferenceList(os.Getenv(awsAuthSchemePreferenceEnv))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2e5f981afbaad9f — Environment-variable access.

pkgs/go/[email protected]/env_config.go:485

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c32e862531f824a6 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:503

		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #daeec78ee6223899 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:515

		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63c6b94ea4b84287 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:528

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #266f7e3ed9335536 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:541

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #264d309d86960c65 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:563

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f0f4088190f71c2 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:582

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #abb7091ffb868935 — Filesystem access.

pkgs/go/[email protected]/env_config.go:656

	b, err := os.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eec2c31289149650 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:680

	if endpt := os.Getenv(fmt.Sprintf("%s_%s", awsEndpointURLEnv, normalizeEnv(sdkID))); endpt != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50dbf3bbb4bf7662 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:733

		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66f4bfab5d06ecb4 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:742

		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b2e7fb42ef38b99 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:757

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfa3b8c9f61bba59 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:784

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48e709f382257074 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:808

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfcaaf5da8f61816 — Environment-variable access.

pkgs/go/[email protected]/env_config.go:831

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77941f8d831bdced — Environment-variable access.

pkgs/go/[email protected]/env_config.go:852

		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #adde436bb969fb07 — Environment-variable access.

pkgs/go/[email protected]/resolve_credentials.go:345

			if authFilePath := os.Getenv(httpProviderAuthFileEnvVar); authFilePath != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c4cec1ab8d1441e — Filesystem access.

pkgs/go/[email protected]/resolve_credentials.go:349

					if contents, err = ioutil.ReadFile(authFilePath); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85dbb3abbb58942b — Environment-variable access.

pkgs/go/[email protected]/resolve_credentials.go:635

	cacheDir := os.Getenv("AWS_LOGIN_CACHE_DIRECTORY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43d3e7b37629d879 — Filesystem access.

pkgs/go/[email protected]/shared_config.go:505

	b, err := ioutil.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/credentials

go dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #1f01cfa376aa6cda — Filesystem access.

pkgs/go/[email protected]/logincreds/file.go:9

	return os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6549cfc9c6cf4ed3 — Filesystem access.

pkgs/go/[email protected]/logincreds/file.go:13

	return os.Create(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fd7cf6491f5e6bf — Environment-variable access.

pkgs/go/[email protected]/processcreds/provider.go:107

	cmd.Env = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #089066dbee7582cd — Filesystem access.

pkgs/go/[email protected]/ssocreds/sso_cached_token.go:148

	fileBytes, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b604725973003d6 — Filesystem access.

pkgs/go/[email protected]/ssocreds/sso_cached_token.go:181

	f, err = os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_RDWR, fileMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f80e8fc689ac44e6 — Filesystem access.

pkgs/go/[email protected]/stscreds/web_identity_provider.go:83

	b, err := ioutil.ReadFile(string(j))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/service/s3

go dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #5913e68dbc26e7c3 — Environment-variable access.

pkgs/go/[email protected]/endpoints.go:219

	_, g := os.LookupEnv("AWS_ENDPOINT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b29d10bbadc146b0 — Environment-variable access.

pkgs/go/[email protected]/endpoints.go:220

	_, s := os.LookupEnv("AWS_ENDPOINT_URL_S3")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/service/sts

go dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #99bbbf5baa0f8359 — Environment-variable access.

pkgs/go/[email protected]/endpoints.go:209

	_, g := os.LookupEnv("AWS_ENDPOINT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fad132d3e5b2e923 — Environment-variable access.

pkgs/go/[email protected]/endpoints.go:210

	_, s := os.LookupEnv("AWS_ENDPOINT_URL_STS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/smithy-go

go dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #79fd0477c0c4bee6 — Filesystem access.

pkgs/go/[email protected]/middleware/generate.go:510

		f, err := os.Create(step.Filepath())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f7785e701fdf917 — Filesystem access.

pkgs/go/[email protected]/ptr/generate.go:29

	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/browserbase/stagehand-go/v3

go dependency

expand_more 13 low-confidence finding(s)

low env_fs dependency Excluded from app score #a453ba2adb65af4a — Environment-variable access.

pkgs/go/[email protected]/client.go:29

	if o, ok := os.LookupEnv("STAGEHAND_API_URL"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be425d9cc59d72f0 — Environment-variable access.

pkgs/go/[email protected]/client.go:31

	} else if o, ok := os.LookupEnv("STAGEHAND_BASE_URL"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8c275f1de8b47d9 — Environment-variable access.

pkgs/go/[email protected]/client.go:34

	if o, ok := os.LookupEnv("BROWSERBASE_API_KEY"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #155067c792016ab3 — Environment-variable access.

pkgs/go/[email protected]/client.go:37

	if o, ok := os.LookupEnv("MODEL_API_KEY"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d226fb9de337cc8 — Environment-variable access.

pkgs/go/[email protected]/client.go:40

	if o, ok := os.LookupEnv("STAGEHAND_CUSTOM_HEADERS"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e6e0d5b6a5e476e — Environment-variable access.

pkgs/go/[email protected]/internal/testutil/testutil.go:13

		if str, ok := os.LookupEnv(SKIP_MOCK_TESTS); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4165fc522cea5d7e — Environment-variable access.

pkgs/go/[email protected]/lib/local/local.go:86

		cacheBase = os.Getenv("LOCALAPPDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #478c7ca255ecd5d6 — Environment-variable access.

pkgs/go/[email protected]/lib/local/local.go:96

		cacheBase = os.Getenv("XDG_CACHE_HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83cdd5f4147d4e78 — Environment-variable access.

pkgs/go/[email protected]/lib/local/local.go:137

	version := os.Getenv("STAGEHAND_SERVER_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #003cbec19ccacfd4 — Filesystem access.

pkgs/go/[email protected]/lib/local/local.go:238

	file, err := os.OpenFile(tmpPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a37dc56c0ebe51fa — Environment-variable access.

pkgs/go/[email protected]/lib/local/local.go:346

	env := append([]string{}, os.Environ()...)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36b15549c16571c8 — Environment-variable access.

pkgs/go/[email protected]/local_client.go:33

		if key := os.Getenv("MODEL_API_KEY"); key != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a80f6862010a909 — Environment-variable access.

pkgs/go/[email protected]/local_client.go:43

		if key := os.Getenv("BROWSERBASE_API_KEY"); key != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/cespare/xxhash/v2

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #06f9171a88edceea — Filesystem access.

pkgs/go/[email protected]/xxhsum/xxhsum.go:24

		f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/denisenkom/go-mssqldb

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #919be51495a0c2fb — Filesystem access.

pkgs/go/[email protected]/msdsn/conn_str.go:92

	pem, err := ioutil.ReadFile(certificate)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/elastic/go-elasticsearch/v8

go dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #6898b354708b6c36 — Environment-variable access.

pkgs/go/[email protected]/elasticsearch.go:183

	compatHeaderEnv := os.Getenv(esCompatHeader)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9a1227889ef4b29 — Environment-variable access.

pkgs/go/[email protected]/elasticsearch.go:227

	compatHeaderEnv := os.Getenv(esCompatHeader)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e00590a9432c2ea — Environment-variable access.

pkgs/go/[email protected]/elasticsearch.go:258

	compatHeaderEnv := os.Getenv(esCompatHeader)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19614fa21ba2e871 — Environment-variable access.

pkgs/go/[email protected]/elasticsearch.go:512

	if envURLs, ok := os.LookupEnv("ELASTICSEARCH_URL"); ok && envURLs != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/eric642/e2b-go-sdk

go dependency

expand_more 20 low-confidence finding(s)

low env_fs dependency Excluded from app score #ce35134f0ce63bae — Environment-variable access.

pkgs/go/[email protected]/config.go:85

		if v := os.Getenv("E2B_DOMAIN"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff92bf1e0aea9eae — Environment-variable access.

pkgs/go/[email protected]/config.go:92

		out.APIKey = os.Getenv("E2B_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81154e52fb6746f5 — Environment-variable access.

pkgs/go/[email protected]/config.go:95

		out.AccessToken = os.Getenv("E2B_ACCESS_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30c7a31c48a8c186 — Environment-variable access.

pkgs/go/[email protected]/config.go:98

		out.Debug = strings.EqualFold(os.Getenv("E2B_DEBUG"), "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b8827e37415fa7c — Environment-variable access.

pkgs/go/[email protected]/config.go:101

		if v := os.Getenv("E2B_API_URL"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b7088213931442b — Environment-variable access.

pkgs/go/[email protected]/config.go:110

		out.SandboxURL = os.Getenv("E2B_SANDBOX_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #850cb5047041dca2 — Environment-variable access.

pkgs/go/[email protected]/examples/basic/main.go:58

	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4b14f28de9b448be — Environment-variable access.

pkgs/go/[email protected]/examples/desktop/main.go:57

	templateID, ok := os.LookupEnv(templateIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7935f363e8dd4a49 — Environment-variable access.

pkgs/go/[email protected]/examples/desktop/main.go:160

	if v := os.Getenv("DESKTOP_BROWSER_URL"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #671070fb5ee2edb9 — Environment-variable access.

pkgs/go/[email protected]/examples/selfhosted/main.go:30

		APIKey: os.Getenv("E2B_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #09d73394a60dc149 — Environment-variable access.

pkgs/go/[email protected]/examples/selfhosted/main.go:32

		APIURL: os.Getenv("E2B_API_URL"), // optional; derived from Domain if empty

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0219f69179990c07 — Environment-variable access.

pkgs/go/[email protected]/examples/selfhosted/main.go:108

	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4471fddc1327d493 — Environment-variable access.

pkgs/go/[email protected]/examples/terminal/main.go:32

		APIKey: os.Getenv("E2B_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #597d1230ac1f1666 — Environment-variable access.

pkgs/go/[email protected]/examples/terminal/main.go:33

		Domain: os.Getenv("E2B_DOMAIN"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #31ebff437977fb6b — Environment-variable access.

pkgs/go/[email protected]/examples/terminal/main.go:34

		APIURL: os.Getenv("E2B_API_URL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b8ed2a8f0715574a — Environment-variable access.

pkgs/go/[email protected]/examples/terminal/main.go:170

	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e46d3f4a97367f1e — Filesystem access.

pkgs/go/[email protected]/template/dockerfile_parser.go:19

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #826c3fe84469825a — Filesystem access.

pkgs/go/[email protected]/template/hash.go:78

			data, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f09592201af73f18 — Filesystem access.

pkgs/go/[email protected]/template/ignore.go:12

	data, err := os.ReadFile(filepath.Join(contextDir, ".dockerignore"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a980027e3d91ea7 — Filesystem access.

pkgs/go/[email protected]/template/tar.go:101

	f, err := os.Open(abs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/gin-gonic/gin

go dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #a7fea1ee6afc805c — Filesystem access.

pkgs/go/[email protected]/context.go:621

	out, err := os.Create(dst)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b64af059db133c7 — Environment-variable access.

pkgs/go/[email protected]/logger.go:227

	if w, ok := out.(*os.File); !ok || os.Getenv("TERM") == "dumb" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #119269a650f1102a — Environment-variable access.

pkgs/go/[email protected]/mode.go:52

	mode := os.Getenv(EnvGinMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0f1b4761845223d — Filesystem access.

pkgs/go/[email protected]/recovery.go:125

			data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f76347d2743b3f43 — Environment-variable access.

pkgs/go/[email protected]/utils.go:143

		if port := os.Getenv("PORT"); port != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/go-sql-driver/mysql

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #5c94b5a65f4397e1 — Filesystem access.

pkgs/go/[email protected]/infile.go:133

			if file, err = os.Open(name); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/goccy/go-json

go dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #027e15db46a6f19f — Filesystem access.

pkgs/go/[email protected]/internal/cmd/generator/main.go:276

	return ioutil.WriteFile(path, buf, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80d188bc36cefd89 — Filesystem access.

pkgs/go/[email protected]/internal/cmd/generator/main.go:280

	file, err := ioutil.ReadFile("vm.go.tmpl")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c72af380c8f3945 — Filesystem access.

pkgs/go/[email protected]/internal/cmd/generator/main.go:298

		if err := ioutil.WriteFile(path, source, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/golang-jwt/jwt/v5

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #305c34121bd58fcd — Filesystem access.

pkgs/go/[email protected]/cmd/jwt/main.go:89

		f, err := os.Open(p)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/gomarkdown/markdown

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #6650bf74a345e7c4 — Filesystem access.

pkgs/go/github.com_gomarkdown_markdown@v0.0.0-20260614204949-e08cff860f76/cmd/printast/main.go:37

		d, err := ioutil.ReadFile(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/lib/pq

go dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #3cb0b31b2b20a366 — Environment-variable access.

pkgs/go/[email protected]/conn.go:236

	filename := os.Getenv("PGPASSFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d929a2f26658ba09 — Environment-variable access.

pkgs/go/[email protected]/conn.go:241

		userHome := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #444852e2dea4844f — Filesystem access.

pkgs/go/[email protected]/conn.go:260

	file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #144bcaede736aab8 — Environment-variable access.

pkgs/go/[email protected]/connector.go:61

	for k, v := range parseEnviron(os.Environ()) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56d7a7f61d8d360c — Environment-variable access.

pkgs/go/[email protected]/oid/gen.go:31

	datname := os.Getenv("PGDATABASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7c6d745dfc7e883 — Environment-variable access.

pkgs/go/[email protected]/oid/gen.go:32

	sslmode := os.Getenv("PGSSLMODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eab6cbdada5d1c31 — Filesystem access.

pkgs/go/[email protected]/oid/gen.go:71

	f, err := os.Create("types.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84e86543ca0a4812 — Filesystem access.

pkgs/go/[email protected]/ssl.go:168

			cert, err = ioutil.ReadFile(sslrootcert)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c35e748a549985ca — Environment-variable access.

pkgs/go/[email protected]/user_posix.go:19

	name := os.Getenv("USER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/nats-io/nats.go

go dependency

expand_more 12 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #ac2502165f8f5160 — Filesystem access.

pkgs/go/[email protected]/examples/nats-bench/main.go:147

		os.WriteFile(*csvFile, []byte(csv), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #34aa3f096973202c — Environment-variable access.

pkgs/go/[email protected]/examples/nats-echo/main.go:201

	url := os.Getenv("ECHO_SVC_GEO_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b2bb162933c633f — Filesystem access.

pkgs/go/[email protected]/jetstream/object.go:1130

	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10261cbeb94d4f10 — Filesystem access.

pkgs/go/[email protected]/jetstream/object.go:1141

	f, err := os.OpenFile(file, os.O_WRONLY|os.O_CREATE, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #335ff9dcbb559d44 — Filesystem access.

pkgs/go/[email protected]/nats.go:1066

				rootPEM, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc9e996b31e1b0b4 — Filesystem access.

pkgs/go/[email protected]/nats.go:6624

	contents, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f46e54e31c3b4a92 — Environment-variable access.

pkgs/go/[email protected]/nats.go:6634

		homeDrive, homePath := os.Getenv("HOMEDRIVE"), os.Getenv("HOMEPATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6c80c95850ccc3b — Environment-variable access.

pkgs/go/[email protected]/nats.go:6635

		userProfile := os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52b34ae0dd24e826 — Environment-variable access.

pkgs/go/[email protected]/nats.go:6650

	home := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc071a08dcba48d1 — Filesystem access.

pkgs/go/[email protected]/nats.go:6673

	contents, err := os.ReadFile(seedFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39ca30a80f8fbe73 — Filesystem access.

pkgs/go/[email protected]/object.go:885

	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa355c0b7ba7f37a — Filesystem access.

pkgs/go/[email protected]/object.go:896

	f, err := os.OpenFile(file, os.O_WRONLY|os.O_CREATE, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/nikolalohinski/gonja

go dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #1510e7e5f536e557 — Filesystem access.

pkgs/go/[email protected]/builtins/filters.go:1742

	out, err := ioutil.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc2ea88bbac4b970 — Filesystem access.

pkgs/go/[email protected]/loaders/filesystem.go:78

	buf, err := ioutil.ReadFile(realPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/peterh/liner

go dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #fe37ec8590f330d5 — Environment-variable access.

pkgs/go/[email protected]/input.go:372

	return !bad[strings.ToLower(os.Getenv("TERM"))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5096b9a378811a4b — Environment-variable access.

pkgs/go/[email protected]/output.go:52

	if strings.Contains(strings.ToLower(os.Getenv("TERM")), "xterm") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/pkoukk/tiktoken-go

go dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #8b4d56fd97e56e64 — Filesystem access.

pkgs/go/[email protected]/load.go:23

		file, err := os.Open(blobpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02fc05ccab3610e0 — Environment-variable access.

pkgs/go/[email protected]/load.go:44

	cacheDir := strings.TrimSpace(os.Getenv("TIKTOKEN_CACHE_DIR"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a70b8fb906ff1da — Environment-variable access.

pkgs/go/[email protected]/load.go:46

		cacheDir = strings.TrimSpace(os.Getenv("DATA_GYM_CACHE_DIR"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59f755806f2ed522 — Filesystem access.

pkgs/go/[email protected]/load.go:56

		return os.ReadFile(cachePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efb27d7f8882ac64 — Filesystem access.

pkgs/go/[email protected]/load.go:69

	if err := os.WriteFile(tmpFilename, contents, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/prometheus/client_golang

go dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #e2665d97b1da991a — Filesystem access.

pkgs/go/[email protected]/prometheus/collectors/gen_go_collector_set.go:136

	if err := os.WriteFile(fname, result, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d8aad5b8bd1f26b — Filesystem access.

pkgs/go/[email protected]/prometheus/gen_go_collector_metrics_set.go:102

	if err := os.WriteFile(fname, result, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #474868b7a8dc93c4 — Filesystem access.

pkgs/go/[email protected]/prometheus/process_collector.go:169

		content, err := os.ReadFile(pidFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9901a68b124e8fa — Filesystem access.

pkgs/go/[email protected]/prometheus/process_collector_darwin.go:57

	if dir, err := os.Open("/dev/fd"); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/redis/go-redis/v9

go dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #cf7da37b6e398ba8 — Environment-variable access.

pkgs/go/[email protected]/maintnotifications/e2e/fault_injector.go:962

	return os.Getenv("E2E_DEBUG") == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa92cf767d33eb9a — Environment-variable access.

pkgs/go/[email protected]/maintnotifications/e2e/proxy_fault_injector_server.go:111

	clusterAddrs := os.Getenv("CLUSTER_ADDRS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efd89565c229bc84 — Environment-variable access.

pkgs/go/[email protected]/maintnotifications/e2e/proxy_fault_injector_server.go:116

	targetHost := os.Getenv("REDIS_TARGET_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4f8f87521217f2f — Environment-variable access.

pkgs/go/[email protected]/maintnotifications/e2e/proxy_fault_injector_server.go:122

	if portStr := os.Getenv("REDIS_TARGET_PORT"); portStr != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/signintech/gopdf

go dependency

expand_more 18 low-confidence finding(s)

low env_fs dependency Excluded from app score #1b9952c989a5dd62 — Filesystem access.

pkgs/go/[email protected]/embedfont_obj.go:26

	b, err := os.ReadFile(e.zfontpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #620cd2e575eb495b — Filesystem access.

pkgs/go/[email protected]/examples/mask-image/example.go:36

	b, err := os.ReadFile(resourcesPath + "/gopher01.jpg")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e81d324c9d4d717f — Filesystem access.

pkgs/go/[email protected]/examples/mask-image/example.go:50

	file, err := os.Open(resourcesPath + "/chilli.jpg")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9b42ed45e5f7c128 — Filesystem access.

pkgs/go/[email protected]/examples/mask-with-rotated-image/example.go:35

	file, err := os.Open(resourcesPath + "/chilli.jpg")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4f2b7c3d09fa7ca1 — Filesystem access.

pkgs/go/[email protected]/examples/outline_example/outline.go:12

	b, err := os.Open(fontPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff8c578574f744a7 — Filesystem access.

pkgs/go/[email protected]/font_container.go:24

	data, err := os.ReadFile(ttfpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #061234f573bd32b3 — Filesystem access.

pkgs/go/[email protected]/fontmaker/core/fontmaker.go:67

	fontbytes, err := os.ReadFile(fontpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f4553dcb0b6bd9b — Filesystem access.

pkgs/go/[email protected]/fontmaker/core/fontmaker.go:77

	err = os.WriteFile(outfolderpath+"/"+gzfilename, buff.Bytes(), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d96e2d145ca33311 — Filesystem access.

pkgs/go/[email protected]/fontmaker/core/fontmaker.go:204

	err = os.WriteFile(exportfile, []byte(str), 0666)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b24822ef358bcb9 — Filesystem access.

pkgs/go/[email protected]/fontmaker/core/fontmaker.go:349

	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b959fc592ed1ae3 — Filesystem access.

pkgs/go/[email protected]/fontmaker/core/fontmaker.go:377

	fileContent, err := os.ReadFile(fontpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b1d10e93eb407f1 — Filesystem access.

pkgs/go/[email protected]/fontmaker/core/fontmaker.go:463

	file, err := os.Open(encodingpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ca0d4fbd83cbba8 — Filesystem access.

pkgs/go/[email protected]/fontmaker/core/ttfparser.go:206

	data, err := os.ReadFile(filepath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #391085feaab8c76c — Filesystem access.

pkgs/go/[email protected]/gopdf.go:1011

	return os.WriteFile(pdfPath, gp.GetBytesPdf(), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ee1f6d2fd8874d6 — Filesystem access.

pkgs/go/[email protected]/gopdf.go:1830

	data, err := os.ReadFile(ttfpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c25cd1183b371e5 — Filesystem access.

pkgs/go/[email protected]/image_holder.go:53

	b, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63eed3a414df35d8 — Filesystem access.

pkgs/go/[email protected]/image_obj.go:122

	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d522bceca5b2a165 — Filesystem access.

pkgs/go/[email protected]/image_obj_parse.go:130

	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/spf13/viper

go dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #2a71d1654f168856 — Filesystem access.

pkgs/go/[email protected]/remote/remote.go:82

		kr, err = os.Open(rp.SecretKeyring())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b38061365f4844c — Environment-variable access.

pkgs/go/[email protected]/util.go:142

		home := os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d741a741f2826166 — Environment-variable access.

pkgs/go/[email protected]/util.go:144

			home = os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c532a167c68ee04 — Environment-variable access.

pkgs/go/[email protected]/util.go:148

	return os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbd12ab85dcccc5e — Environment-variable access.

pkgs/go/[email protected]/viper.go:563

	val, ok := os.LookupEnv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/xuri/excelize/v2

go dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #57933869ec038159 — Filesystem access.

pkgs/go/[email protected]/excelize.go:134

	file, err := os.Open(filepath.Clean(filename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb8d75309b687b1d — Filesystem access.

pkgs/go/[email protected]/file.go:79

	file, err := os.OpenFile(filepath.Clean(name), os.O_WRONLY|os.O_TRUNC|os.O_CREATE, os.ModePerm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae78d97e1bdfe705 — Filesystem access.

pkgs/go/[email protected]/lib.go:135

	file, err = os.Open(path.(string))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f85c8d0bde73d9b — Filesystem access.

pkgs/go/[email protected]/picture.go:205

	file, _ := os.ReadFile(filepath.Clean(name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27fb988628273ab7 — Filesystem access.

pkgs/go/[email protected]/sheet.go:539

	file, _ := os.ReadFile(filepath.Clean(picture))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/yfedoseev/office_oxide/go

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #4c1ac7cb7db500b7 — Filesystem access.

pkgs/go/[email protected]/cmd/install/main.go:156

			f, err := os.OpenFile(target, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(hdr.Mode)&0o777|0o600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/yfedoseev/pdf_oxide/go

go dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #682b927ec4b71bab — Filesystem access.

pkgs/go/[email protected]/cmd/install/main.go:394

	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, filePerm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db327b321ba03831 — Filesystem access.

pkgs/go/[email protected]/cmd/install/main.go:476

	f, err := os.OpenFile(outPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, filePerm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93b64760376419ba — Environment-variable access.

pkgs/go/[email protected]/pdf_oxide_purego.go:101

	if env := os.Getenv("PDF_OXIDE_LIB_PATH"); env != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #ba862d700d529489 — Environment-variable access.

pkgs/go/go.opentelemetry.io_otel_exporters_otlp_otlptrace_otlptracehttp@v1.44.0/internal/x/x.go:46

		vRaw := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/sdk

go dependency

expand_more 10 low-confidence finding(s)

low env_fs dependency Excluded from app score #caf611aee563ce3d — Environment-variable access.

pkgs/go/[email protected]/internal/x/x.go:46

		vRaw := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92377e1bd27417ab — Filesystem access.

pkgs/go/[email protected]/resource/container.go:47

		return os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3608e3200019aca — Environment-variable access.

pkgs/go/[email protected]/resource/env.go:39

	attrs := strings.TrimSpace(os.Getenv(resourceAttrKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec8d6a3d8423e2be — Environment-variable access.

pkgs/go/[email protected]/resource/env.go:40

	svcName := strings.TrimSpace(os.Getenv(svcNameKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a9fabcc65287a3f — Filesystem access.

pkgs/go/[email protected]/resource/host_id_readfile.go:11

	b, err := os.ReadFile(filename) // nolint:gosec // false positive

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a6c4f8da17c4847 — Filesystem access.

pkgs/go/[email protected]/resource/os_unix.go:72

		file, err := os.Open(c)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fc1f7001a30810a — Environment-variable access.

pkgs/go/[email protected]/trace/internal/env/env.go:64

		value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d703c8d32bfded7 — Environment-variable access.

pkgs/go/[email protected]/trace/internal/env/env.go:84

	value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2184c4131dfe32d8 — Environment-variable access.

pkgs/go/[email protected]/trace/sampler_env.go:49

	sampler, ok := os.LookupEnv(tracesSamplerKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dccac05950a7a81 — Environment-variable access.

pkgs/go/[email protected]/trace/sampler_env.go:55

	samplerArg, hasSamplerArg := os.LookupEnv(tracesSamplerArgKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/trace

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #4d62b0e9fda8f506 — Environment-variable access.

pkgs/go/[email protected]/auto.go:665

		strV := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.uber.org/zap

go dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #cd076ebb9404f8cb — Environment-variable access.

pkgs/go/[email protected]/internal/ztest/timeout.go:55

	if v := os.Getenv("TEST_TIMEOUT_SCALE"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/crypto

go dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #1d1fdc796e787cd0 — Filesystem access.

pkgs/go/[email protected]/acme/autocert/cache.go:50

		data, err = os.ReadFile(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a0bada4b5e827fd — Environment-variable access.

pkgs/go/[email protected]/internal/testenv/exec.go:41

			if s := os.Getenv("GO_TEST_TIMEOUT_SCALE"); s != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47781ab62ddd1b18 — Filesystem access.

pkgs/go/[email protected]/ssh/knownhosts/knownhosts.go:420

		f, err := os.Open(fn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb1670e9edccad0f — Filesystem access.

pkgs/go/[email protected]/x509roots/gen_fallback_bundle.go:48

		f, err := os.Open(*certDataPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b91773fa7a2a6b08 — Filesystem access.

pkgs/go/[email protected]/x509roots/gen_fallback_bundle.go:136

	if err := os.WriteFile(*output, formatted, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50c45a3289f3517e — Filesystem access.

pkgs/go/[email protected]/x509roots/gen_fallback_bundle.go:140

	if err := os.WriteFile(*derOutput, rawCertsData.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/net

go dependency

expand_more 28 low-confidence finding(s)

low env_fs dependency Excluded from app score #254d1fab2699cd66 — Filesystem access.

pkgs/go/[email protected]/html/atom/gen.go:50

	if err := os.WriteFile(name, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c46386eea1eff3b6 — Environment-variable access.

pkgs/go/[email protected]/http/httpproxy/proxy.go:95

		CGI:        os.Getenv("REQUEST_METHOD") != "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ceb14367f8c5c89 — Environment-variable access.

pkgs/go/[email protected]/http/httpproxy/proxy.go:101

		if val := os.Getenv(n); val != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a7e572bff6503af — Environment-variable access.

pkgs/go/[email protected]/http2/gotrack.go:21

var DebugGoroutines = os.Getenv("DEBUG_HTTP2_GOROUTINES") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cf4f1695452636f — Environment-variable access.

pkgs/go/[email protected]/http2/h2c/h2c.go:52

	e := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc027bec8b2e0b59 — Filesystem access.

pkgs/go/[email protected]/http2/hpack/gen.go:178

	if err := os.WriteFile(name, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d8db375886238c4 — Environment-variable access.

pkgs/go/[email protected]/http2/http2.go:53

	e := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #126fa65be797475a — Filesystem access.

pkgs/go/[email protected]/internal/iana/gen.go:71

	if err := os.WriteFile("const.go", b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75b64567a146fa48 — Environment-variable access.

pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:67

	if keylog := os.Getenv("SSLKEYLOGFILE"); keylog != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ed936fa7c4fc444 — Filesystem access.

pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:68

		f, err := os.Create(keylog)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #805a63b11650ca38 — Environment-variable access.

pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:76

	testcase := os.Getenv("TESTCASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57c7b7b23d1f6110 — Filesystem access.

pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:216

	f, err := os.Open(filepath.Join(*root, string(req)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #057aec5960642e8e — Filesystem access.

pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:267

	file, err := os.Create(filepath.Join(*output, u.Path[1:]))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fafe049f3be0cd4f — Filesystem access.

pkgs/go/[email protected]/ipv4/gen.go:41

	f, err := os.Open(defs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e30e74b7a444e9b — Filesystem access.

pkgs/go/[email protected]/ipv4/gen.go:63

	if err := os.WriteFile(zsys, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da1412b689ab415e — Filesystem access.

pkgs/go/[email protected]/ipv4/gen.go:102

	if err := os.WriteFile("iana.go", b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d9d849e6c6009c0 — Filesystem access.

pkgs/go/[email protected]/ipv6/gen.go:41

	f, err := os.Open(defs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79266a1869276138 — Filesystem access.

pkgs/go/[email protected]/ipv6/gen.go:63

	if err := os.WriteFile(zsys, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2713be152a38eff0 — Filesystem access.

pkgs/go/[email protected]/ipv6/gen.go:102

	if err := os.WriteFile("iana.go", b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df21698e34ef2ce4 — Environment-variable access.

pkgs/go/[email protected]/proxy/proxy.go:138

		e.val = os.Getenv(n)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf42336de236383c — Filesystem access.

pkgs/go/[email protected]/publicsuffix/gen.go:275

	return os.WriteFile(filename, b, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8aa31a1bd1527303 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/publicsuffix/gen.go:279

	res, err := http.Get(gitCommitURL)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #86a94e4905e9f6a8 — Filesystem access.

pkgs/go/[email protected]/publicsuffix/gen.go:320

	if err := os.WriteFile("data/text", []byte(combinedText), 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36bb56024dc1040a — Filesystem access.

pkgs/go/[email protected]/publicsuffix/gen.go:333

	if err := os.WriteFile("data/nodes", nodes, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df20832bee9d7e97 — Filesystem access.

pkgs/go/[email protected]/publicsuffix/gen.go:341

	if err := os.WriteFile("data/children", children, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65ed7ec68c224396 — Environment-variable access.

pkgs/go/[email protected]/quic/log.go:19

	s := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cfe2c566200a944 — Filesystem access.

pkgs/go/[email protected]/quic/qlog/qlog.go:181

		w, err = os.OpenFile(filepath.Join(opts.Dir, filename), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0666)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62ce7dce87ec049b — Filesystem access.

pkgs/go/[email protected]/webdav/file.go:95

	f, err := os.OpenFile(name, flag, perm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/text

go dependency

expand_more 31 low-confidence finding(s)

low env_fs dependency Excluded from app score #e8b27e0aa2ff1945 — Filesystem access.

pkgs/go/[email protected]/cmd/gotext/main.go:328

			if err := os.WriteFile("doc.go", b, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #97b9fcde268acc36 — Filesystem access.

pkgs/go/[email protected]/collate/tools/colcmp/colcmp.go:122

		f, err := os.Create(*cpuprofile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7acae460051ee406 — Filesystem access.

pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:160

	dst, err := os.ReadFile(dstFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #484115d388246e42 — Filesystem access.

pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:162

		if dst, err = os.ReadFile("../" + dstFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80ec695f5e9d1673 — Filesystem access.

pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:166

	src, err := os.ReadFile(srcFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d04f033a89d304b7 — Filesystem access.

pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:168

		if src, err = os.ReadFile("../" + srcFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #9ec105393add1e6c — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/encoding/korean/maketables.go:26

	res, err := http.Get("http://encoding.spec.whatwg.org/index-euc-kr.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a2d249c24261cff9 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/encoding/simplifiedchinese/maketables.go:31

	res, err := http.Get("http://encoding.spec.whatwg.org/index-gb18030.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fd87826e0d8bc326 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/encoding/simplifiedchinese/maketables.go:57

	res, err := http.Get("http://encoding.spec.whatwg.org/index-gbk.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c339e7f4faa8a313 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/encoding/traditionalchinese/maketables.go:26

	res, err := http.Get("http://encoding.spec.whatwg.org/index-big5.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #1211588af38c5aa2 — Environment-variable access.

pkgs/go/[email protected]/gen.go:81

		goroot := os.Getenv("GOROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b3932df1e0efcee — Filesystem access.

pkgs/go/[email protected]/gen.go:150

	w, err := os.OpenFile(file, os.O_APPEND|os.O_WRONLY, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d018d2760ab7c43f — Filesystem access.

pkgs/go/[email protected]/gen.go:257

		b, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5435c20b87dd8f87 — Filesystem access.

pkgs/go/[email protected]/gen.go:276

		return os.WriteFile(file, b, 0666)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67ea0b0b901e2811 — Environment-variable access.

pkgs/go/[email protected]/internal/export/unicode/gen.go:45

	if v := os.Getenv("UNICODE_VERSION"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7adf03f51fbdf529 — Filesystem access.

pkgs/go/[email protected]/internal/gen/code.go:53

	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92c22d5f2bd01d19 — Filesystem access.

pkgs/go/[email protected]/internal/gen/code.go:73

	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ff5e4a34dd4fbae — Environment-variable access.

pkgs/go/[email protected]/internal/gen/gen.go:57

	if v := os.Getenv(name); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #791b92f7a6fa2d4d — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:174

		os.WriteFile(readme, []byte(readmeTxt), permissions)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c19dd36a32822184 — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:207

	if f, err := os.Open(file); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9d2baf7e41bafbd — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:217

	if err := os.WriteFile(file, b, permissions); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #862027e73b03d5bf — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:257

	w, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb065f287ad19981 — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:284

		b, err := os.ReadFile(oldFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ccde26287b9ee94 — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:289

		err = os.WriteFile(oldFile, b, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c6001f7175dae98 — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:305

	w, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #191707c900278311 — Filesystem access.

pkgs/go/[email protected]/internal/gen/gen.go:338

	src, err := os.ReadFile(inFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b33b09cf8ff201cf — Filesystem access.

pkgs/go/[email protected]/internal/testtext/codesize.go:34

	if err := os.WriteFile(filename, []byte(s), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a8370667c4e3d07 — Filesystem access.

pkgs/go/[email protected]/message/pipeline/pipeline.go:231

		b, err := ioutil.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c036414cc0bf4d4 — Filesystem access.

pkgs/go/[email protected]/message/pipeline/pipeline.go:362

		if err := ioutil.WriteFile(file, data, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be77e034179424f0 — Filesystem access.

pkgs/go/[email protected]/message/pipeline/rewrite.go:53

				if w, err = os.Create(conf.Fset.File(f.Pos()).Name()); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #124333ed24d8bbb5 — Filesystem access.

pkgs/go/[email protected]/unicode/cldr/decode.go:132

	return os.Open(pl[i])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google.golang.org/genai

go dependency

expand_more 23 low-confidence finding(s)

low env_fs dependency Excluded from app score #0c81980cdfc58d23 — Environment-variable access.

pkgs/go/[email protected]/client.go:128

	if v, ok := os.LookupEnv("GOOGLE_GENAI_USE_VERTEXAI"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c16be390a17a3d3a — Environment-variable access.

pkgs/go/[email protected]/client.go:131

	if v, ok := os.LookupEnv("GOOGLE_API_KEY"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8bc057e4be2a326f — Environment-variable access.

pkgs/go/[email protected]/client.go:134

	if v, ok := os.LookupEnv("GEMINI_API_KEY"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3df2f44a07dc8446 — Environment-variable access.

pkgs/go/[email protected]/client.go:137

	if v, ok := os.LookupEnv("GOOGLE_CLOUD_PROJECT"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7fb7503d86af72c — Environment-variable access.

pkgs/go/[email protected]/client.go:140

	if v, ok := os.LookupEnv("GOOGLE_CLOUD_LOCATION"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32e228f88f45755d — Environment-variable access.

pkgs/go/[email protected]/client.go:143

	if v, ok := os.LookupEnv("GOOGLE_CLOUD_REGION"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1060ebf6e5350d2c — Environment-variable access.

pkgs/go/[email protected]/client.go:146

	if v, ok := os.LookupEnv("GOOGLE_GEMINI_BASE_URL"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd6391ada3b381d6 — Environment-variable access.

pkgs/go/[email protected]/client.go:149

	if v, ok := os.LookupEnv("GOOGLE_VERTEX_BASE_URL"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cc66bafa611d7163 — Filesystem access.

pkgs/go/[email protected]/examples/files/upload_file.go:57

	r, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #fd04bedd569bbdcb — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/examples/live/live_streaming_server.go:155

	resp, err := http.Get("http://storage.googleapis.com/cloud-samples-data/video/animals.mp4")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #fa415ddd0b5346e4 — Environment-variable access.

pkgs/go/[email protected]/examples/live/live_streaming_server.go:184

	port := os.Getenv("PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #e1bcfa192681e5e0 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/examples/live_with_ephemeral_token/live_streaming_server.go:178

	resp, err := http.Get("http://storage.googleapis.com/cloud-samples-data/video/animals.mp4")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #f578f464977746bc — Environment-variable access.

pkgs/go/[email protected]/examples/live_with_ephemeral_token/live_streaming_server.go:213

	port := os.Getenv("PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling reachable #69d48997ea3ef36c — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/examples/models/edit_image/image.go:53

	resp, err := http.Get("https://storage.googleapis.com/cloud-samples-data/generative-ai/image/scones.jpg")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling reachable #17c9fedc2c88279e — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/examples/models/segment_image/segment_image.go:55

	resp, err := http.Get("https://storage.googleapis.com/cloud-samples-data/generative-ai/image/scones.jpg")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling reachable #0058e5540e401a90 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/go/[email protected]/examples/models/upscale_image/image.go:53

	resp, err := http.Get("https://storage.googleapis.com/cloud-samples-data/generative-ai/image/scones.jpg")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #70e8bc7e44798af6 — Filesystem access.

pkgs/go/[email protected]/files.go:668

	osf, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aff60913aad88e56 — Filesystem access.

pkgs/go/[email protected]/filesearchstores.go:851

	osf, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fd44c4a62a79bbd — Filesystem access.

pkgs/go/[email protected]/internal/changefinder/main.go:159

	f, err := os.OpenFile(path.Join(root, mod, "CHANGES.md"), os.O_APPEND|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16e4821d0c7ff0c3 — Environment-variable access.

pkgs/go/[email protected]/replay_api_client.go:52

	replaysDirectory := os.Getenv("GOOGLE_GENAI_REPLAYS_DIRECTORY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfde52bc87b63beb — Filesystem access.

pkgs/go/[email protected]/replay_api_client.go:140

	dat, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b84355fa435ffd0 — Filesystem access.

pkgs/go/[email protected]/tokenizer/tokenizer.go:397

	cacheData, err := os.ReadFile(cachePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3c7d19b45154fed — Filesystem access.

pkgs/go/[email protected]/tokenizer/tokenizer.go:412

		err = os.WriteFile(cachePath, cacheData, 0660)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google.golang.org/grpc

go dependency

expand_more 50 low-confidence finding(s)

low env_fs dependency Excluded from app score #8f5b63df5de85644 — Filesystem access.

pkgs/go/[email protected]/authz/grpc_authz_server_interceptors.go:143

	policyContents, err := os.ReadFile(i.policyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5ba5ba816ccaec4b — Filesystem access.

pkgs/go/[email protected]/benchmark/benchmain/main.go:961

		f, err := os.Create(opts.cpuProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #028b0d6b096e06b1 — Filesystem access.

pkgs/go/[email protected]/benchmark/benchmain/main.go:979

		f, err := os.Create(opts.memProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fa5ad99ea3651f02 — Filesystem access.

pkgs/go/[email protected]/benchmark/benchmain/main.go:992

		f, err := os.Create(opts.benchmarkResultFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7679771d9f04c75e — Filesystem access.

pkgs/go/[email protected]/benchmark/benchresult/main.go:44

	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #59e3dfa80df110c0 — Filesystem access.

pkgs/go/[email protected]/benchmark/benchresult/main.go:117

	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #712bbead1b512f31 — Filesystem access.

pkgs/go/[email protected]/benchmark/client/main.go:104

	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3c3fd58d60c8e3d1 — Filesystem access.

pkgs/go/[email protected]/benchmark/client/main.go:117

	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7f01664976e13e73 — Filesystem access.

pkgs/go/[email protected]/benchmark/server/main.go:66

	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8d8c37417d1e0c33 — Filesystem access.

pkgs/go/[email protected]/benchmark/server/main.go:85

	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7997c749c0246eef — Filesystem access.

pkgs/go/[email protected]/benchmark/stats/curve.go:83

	data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #191d33cabec4f12c — Filesystem access.

pkgs/go/[email protected]/benchmark/stats/curve.go:104

	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #751b015c3c14268a — Filesystem access.

pkgs/go/[email protected]/credentials/jwt/file_reader.go:50

	tokenBytes, err := os.ReadFile(r.tokenFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f149c9060f5f8ef — Filesystem access.

pkgs/go/[email protected]/credentials/oauth/oauth.go:76

	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27083d4e3e921692 — Filesystem access.

pkgs/go/[email protected]/credentials/oauth/oauth.go:195

	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c3d873efe8d86a3 — Filesystem access.

pkgs/go/[email protected]/credentials/tls.go:284

	b, err := os.ReadFile(certFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86fa76d8b83f68e2 — Filesystem access.

pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:164

	certFileContents, err := os.ReadFile(w.opts.CertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be8bd12ac2224323 — Filesystem access.

pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:169

	keyFileContents, err := os.ReadFile(w.opts.KeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dccac607955bc47c — Filesystem access.

pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:211

	spiffeBundleMapContents, err := os.ReadFile(w.opts.SPIFFEBundleMapFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8df9bd3b0837895b — Filesystem access.

pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:230

	rootFileContents, err := os.ReadFile(w.opts.RootFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #717bfa24939da6e8 — Filesystem access.

pkgs/go/[email protected]/experimental/credentials/tls.go:199

	b, err := os.ReadFile(certFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8295c17f8239bc5 — Environment-variable access.

pkgs/go/[email protected]/grpclog/loggerv2.go:65

	logLevel := os.Getenv("GRPC_GO_LOG_SEVERITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f6f93e59b2bd1b1 — Environment-variable access.

pkgs/go/[email protected]/grpclog/loggerv2.go:76

	vLevel := os.Getenv("GRPC_GO_LOG_VERBOSITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #133ca9c883b11862 — Environment-variable access.

pkgs/go/[email protected]/grpclog/loggerv2.go:81

	jsonFormat := strings.EqualFold(os.Getenv("GRPC_GO_LOG_FORMATTER"), "json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10903a1c83dcdec2 — Environment-variable access.

pkgs/go/[email protected]/internal/binarylog/binarylog.go:77

	configStr := os.Getenv(envStr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b3542fd69533e56 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/envconfig.go:149

		return !strings.EqualFold(os.Getenv(envVar), "false")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d8f334f27f23b24 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/envconfig.go:152

	return strings.EqualFold(os.Getenv(envVar), "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #692bb7942baf3362 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/envconfig.go:156

	v, err := strconv.ParseUint(os.Getenv(envVar), 10, 64)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46a549eab79c56e6 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/envconfig.go:174

	v := os.Getenv(envVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3019f3f5f1f7fa9 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/observability.go:34

	ObservabilityConfig = os.Getenv(envObservabilityConfig)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2586cef5f875464 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/observability.go:41

	ObservabilityConfigFile = os.Getenv(envObservabilityConfigFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72df6477ddf80801 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/xds.go:46

	XDSBootstrapFileName = os.Getenv(XDSBootstrapFileNameEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #666d64b420241737 — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/xds.go:52

	XDSBootstrapFileContent = os.Getenv(XDSBootstrapFileContentEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6df7f0b4f938b0ae — Environment-variable access.

pkgs/go/[email protected]/internal/envconfig/xds.go:55

	C2PResolverTestOnlyTrafficDirectorURI = os.Getenv("GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68dbd0aa5f52b881 — Filesystem access.

pkgs/go/[email protected]/internal/googlecloud/manufacturer_linux.go:26

	return os.ReadFile(linuxProductNameFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8bb395bfcfc5b1ca — Environment-variable access.

pkgs/go/[email protected]/internal/grpctest/tlogger.go:78

	if vLevelEnv, found := os.LookupEnv("GRPC_GO_LOG_VERBOSITY_LEVEL"); found {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94c62434888afe8d — Filesystem access.

pkgs/go/[email protected]/internal/testutils/tls_creds.go:39

	b, err := os.ReadFile(testdata.Path("x509/server_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2cf16a0f463b4baa — Filesystem access.

pkgs/go/[email protected]/internal/testutils/tls_creds.go:63

	b, err := os.ReadFile(testdata.Path("x509/client_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b178c96c861958e — Filesystem access.

pkgs/go/[email protected]/internal/testutils/tls_creds.go:89

	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5683d11aa1c3d3a — Filesystem access.

pkgs/go/[email protected]/internal/testutils/tls_creds.go:115

	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2eef76bf2d84071 — Filesystem access.

pkgs/go/[email protected]/internal/testutils/tls_creds.go:143

	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #442f12d18e44c7ea — Filesystem access.

pkgs/go/[email protected]/internal/testutils/xds/e2e/bootstrap.go:158

	data, err := os.ReadFile(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a019967f7d0b5a0c — Filesystem access.

pkgs/go/[email protected]/internal/testutils/xds/e2e/bootstrap.go:162

	if err := os.WriteFile(dst, data, os.ModePerm); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd9918f5e47dbf13 — Filesystem access.

pkgs/go/[email protected]/internal/testutils/xds_bootstrap.go:42

	if err := os.WriteFile(f.Name(), bootstrapContents, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ee7ffda00d0d36c — Filesystem access.

pkgs/go/[email protected]/interop/client/client.go:222

			b, err := os.ReadFile(*caFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cc65dc1ee517aff — Filesystem access.

pkgs/go/[email protected]/interop/test_utils.go:285

	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #312e084605ac820b — Filesystem access.

pkgs/go/[email protected]/profiling/cmd/catapult.go:378

	streamStatsCatapultJSONFile, err := os.Create(streamStatsCatapultJSONFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0de85c285f5cb82a — Filesystem access.

pkgs/go/[email protected]/profiling/cmd/local.go:29

	snapshotFile, err := os.Open(snapshotFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9484b5faa9ad3c01 — Filesystem access.

pkgs/go/[email protected]/profiling/cmd/remote.go:54

	file, err := os.Create(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bac280bb36d8236 — Environment-variable access.

pkgs/go/[email protected]/stats/opentelemetry/csm/pluginoption.go:168

	if val, ok := os.LookupEnv(name); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gopkg.in/natefinch/lumberjack.v2

go dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #6d47657f8a525288 — Filesystem access.

pkgs/go/[email protected]/chown_linux.go:12

	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbc92ef18488ee78 — Filesystem access.

pkgs/go/[email protected]/lumberjack.go:235

	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d312574f07de324 — Filesystem access.

pkgs/go/[email protected]/lumberjack.go:280

	file, err := os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #883d29e1fb66eb15 — Filesystem access.

pkgs/go/[email protected]/lumberjack.go:469

	f, err := os.Open(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf7cdbe52a14be0e — Filesystem access.

pkgs/go/[email protected]/lumberjack.go:486

	gzf, err := os.OpenFile(dst, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, fi.Mode())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

dashscope prod — no sdist (wheels only)
infinity-emb prod — download error: [Errno 101] Network is unreachable
infinity-sdk prod — sdist exceeds byte cap
onnxruntime prod — no sdist (wheels only)
onnxruntime-gpu prod — no sdist (wheels only)
opencv-python prod — sdist exceeds byte cap
opencv-python-headless prod — sdist exceeds byte cap
spacy prod — no sdist (wheels only)
en-core-web-sm prod — pypi 404
selenium-wire prod — sdist exceeds byte cap
sqlglotrs prod — no python source in sdist
word2number prod — extract failed: not a gzip file
github.com/infiniflow/infinity-go-sdk prod — proxy 404
google.golang.org/api prod — module zip exceeds byte cap

verified_user No application data leak found

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz Application data flows

</> First-Party Code

first-party (go)

first-party (python)

</> Dependencies

github.com/minio/minio-go/v7

cloud.google.com/go/storage

github.com/alibabacloud-go/darabonba-openapi/v2

github.com/alicebob/miniredis/v2

github.com/aws/aws-sdk-go-v2

github.com/aws/aws-sdk-go-v2/config

github.com/aws/aws-sdk-go-v2/credentials

github.com/aws/aws-sdk-go-v2/service/s3

github.com/aws/aws-sdk-go-v2/service/sts

github.com/aws/smithy-go

github.com/browserbase/stagehand-go/v3

github.com/cespare/xxhash/v2

github.com/denisenkom/go-mssqldb

github.com/elastic/go-elasticsearch/v8

github.com/eric642/e2b-go-sdk

github.com/gin-gonic/gin

github.com/go-sql-driver/mysql

github.com/goccy/go-json

github.com/golang-jwt/jwt/v5

github.com/gomarkdown/markdown

github.com/lib/pq

github.com/nats-io/nats.go

github.com/nikolalohinski/gonja

github.com/peterh/liner

github.com/pkoukk/tiktoken-go

github.com/prometheus/client_golang

github.com/redis/go-redis/v9

github.com/signintech/gopdf

github.com/spf13/viper

github.com/xuri/excelize/v2

github.com/yfedoseev/office_oxide/go

github.com/yfedoseev/pdf_oxide/go

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

go.opentelemetry.io/otel/sdk

go.opentelemetry.io/otel/trace

go.uber.org/zap

golang.org/x/crypto

golang.org/x/net

golang.org/x/text

google.golang.org/genai

google.golang.org/grpc

gopkg.in/natefinch/lumberjack.v2

Skipped dependencies