Close Open Privacy Scan
App Privacy Score
Low risk · 1304 finding(s)
Based on: 2 first-party package(s) · 19/23 deps analyzed
Dependency score: 82 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
base-ui.comdatabase.windows.netdbhub.aigithub.comjson-schema.orgreact.devreactjs.orgwww.w3.org
</> First-Party Code
first-party (npm)
npm first-partyexpand_more 369 low-confidence finding(s)
low env_fs — Filesystem access. 178 locations
low env_fs — Environment-variable access. 185 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 6 locations
first-party (npm): frontend
npm first-partyexpand_more 2 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
</> Dependencies
@base-ui/react
npm dependencyexpand_more 820 low-confidence finding(s)
low env_fs — Environment-variable access. 820 locations
@modelcontextprotocol/sdk
npm dependencyexpand_more 38 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 22 locations
const response = await fetch(url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
writeFileSync(outputPath, fullContent, 'utf-8');Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 14 locations
class-variance-authority
npm dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
dotenv
npm dependencyexpand_more 18 low-confidence finding(s)
low env_fs — Environment-variable access. 16 locations
low env_fs — Filesystem access. 2 locations
express
npm dependencyexpand_more 1 low-confidence finding(s)
var env = process.env.NODE_ENV || 'development';Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
react
npm dependencyexpand_more 14 low-confidence finding(s)
low env_fs — Environment-variable access. 14 locations
react-dom
npm dependencyexpand_more 25 low-confidence finding(s)
low env_fs — Environment-variable access. 25 locations
ssh-config
npm dependencyexpand_more 1 low-confidence finding(s)
userInfo = { username: process.env.USER || process.env.USERNAME || '' };Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
ssh2
npm dependencyexpand_more 13 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
const forceFailOnNonZero = (process.env.CI_CHECK_FAIL === 'ssh2');Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
Skipped dependencies
Production
- @codemirror/commands prod — dist-only: no readable source
- @codemirror/state prod — dist-only: no readable source
- @codemirror/view prod — dist-only: no readable source
- tw-animate-css prod — no javascript source