Close Open Privacy Scan

link https://github.com/nadeem-shaikh/treehouse
bolt Snapshot: commit 67f31ce
science engine v2
schedule 2026-07-01T05:27:54.336924+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 162 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 162 low
First-party packages: 1
Dependency packages: 5
Ecosystem: go

swap_horiz Application data flows

No high- or medium-confidence application data-flow findings in this scan.

</> First-Party Code

first-party (go)

go first-party
expand_more 24 low-confidence finding(s)
low env_fs production #e3a69063dc62610d — Environment-variable access.
repo/cmd/get.go:114 
		holder = os.Getenv("TREEHOUSE_LEASE_HOLDER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b5b445468874ce4 — Filesystem access.
repo/cmd/init.go:30 
		f, err := os.Create(dest)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b1c31b14353131cb — Environment-variable access.
repo/cmd/return_cmd.go:72 
	if env := os.Getenv("TREEHOUSE_DIR"); env != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4dad50519e5e75bc — Environment-variable access.
repo/cmd/root.go:33 
		if version == "dev" || os.Getenv("TREEHOUSE_NO_UPDATE_CHECK") == "1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83717dac127fc3ce — Filesystem access.
repo/internal/config/gitignore.go:44 
	existing, err := os.ReadFile(gitignorePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #88c75c9a81f0bf16 — Filesystem access.
repo/internal/config/gitignore.go:55 
	f, err := os.OpenFile(gitignorePath, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3c4f4aff54f12493 — Environment-variable access.
repo/internal/hooks/command_windows.go:12 
	shell := os.Getenv("COMSPEC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7ea3491f96342a21 — Filesystem access.
repo/internal/pool/prune.go:757 
	data, err := os.ReadFile(gitFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #919d5bdb535ffc98 — Filesystem access.
repo/internal/pool/state.go:42 
	data, err := os.ReadFile(stateFilePath(poolDir))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9cc55f511841ee97 — Filesystem access.
repo/internal/pool/state.go:61 
	return os.WriteFile(stateFilePath(poolDir), data, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7c6d530336e8a33a — Filesystem access.
repo/internal/pool/state.go:70 
	f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_RDWR, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cee9639437c53030 — Environment-variable access.
repo/internal/shell/shell.go:10 
	shellPath := os.Getenv("SHELL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5c6e36cdd9861e19 — Environment-variable access.
repo/internal/shell/shell.go:13 
			shellPath = os.Getenv("COMSPEC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #926c3651aec11f75 — Environment-variable access.
repo/internal/shell/shell.go:24 
	cmd.Env = append(os.Environ(), env...)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f367dc77bb8bdf0 — Filesystem access.
repo/internal/updater/updater.go:117 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ba986ea20986dfc — Filesystem access.
repo/internal/updater/updater.go:143 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e3a2076056c99bb5 — Environment-variable access.
repo/internal/updater/updater.go:182 
	cmd.Env = append(os.Environ(), "TREEHOUSE_NO_UPDATE_CHECK=1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8097b52e9d23fa47 — Filesystem access.
repo/internal/updater/updater.go:184 
	devNull, err := os.Open(os.DevNull)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9718868b911f8a0f — Filesystem access.
repo/internal/updater/updater.go:378 
	return os.WriteFile(path, data, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b6311e2689f8cb5e — Filesystem access.
repo/internal/updater/updater.go:411 
	f, err := os.Open(archivePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #015420da635c26c7 — Filesystem access.
repo/internal/updater/updater.go:480 
	f, err := os.Open(archivePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #198610f1ab858c9e — Filesystem access.
repo/internal/updater/updater.go:598 
	src, err := os.Open(newBinary)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4fa837dc2cfa3002 — Filesystem access.
repo/internal/updater/updater.go:635 
	src, err := os.Open(newBinary)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10ea974b0b2be775 — Filesystem access.
repo/internal/updater/updater.go:641 
	dst, err := os.OpenFile(target, os.O_WRONLY|os.O_TRUNC, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

github.com/BurntSushi/toml

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #4064fd16d66cbc15 — Filesystem access.
pkgs/go/[email protected]/cmd/tomlv/main.go:48 
		fp, err := os.Open(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b383a2b1aa325cd — Filesystem access.
pkgs/go/[email protected]/decode.go:41 
	fp, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/fatih/color

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #9637c5984ceb957c — Environment-variable access.
pkgs/go/[email protected]/color.go:22 
	NoColor = noColorIsSet() || os.Getenv("TERM") == "dumb" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c25a95aae43a2f54 — Environment-variable access.
pkgs/go/[email protected]/color.go:40 
	return os.Getenv("NO_COLOR") != ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/shirou/gopsutil/v4

go dependency
expand_more 59 low-confidence finding(s)
low env_fs dependency Excluded from app score #8964a2e285f41040 — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu_plan9.go:22 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ade21b094f7cbd7f — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:550 
	if f, err := os.Open(udevDataPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f227ed03327c532c — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:582 
	model, _ := os.ReadFile(filepath.Join(devicePath, "model"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbd45d86043da45d — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:583 
	serial, _ := os.ReadFile(filepath.Join(devicePath, "serial"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01b20ef1ccb6cde9 — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:595 
		dmname, err := os.ReadFile(dmnameFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e74f4ea11332279 — Filesystem access.
pkgs/go/[email protected]/disk/disk_solaris.go:51 
	f, err := os.Open(_MNTTAB)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f12e50215b2eddfb — Filesystem access.
pkgs/go/[email protected]/host/host_darwin.go:54 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa328e682bf585b6 — Filesystem access.
pkgs/go/[email protected]/host/host_freebsd.go:52 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7adf95746bd4318b — Filesystem access.
pkgs/go/[email protected]/host/host_freebsd.go:109 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5f30f07ba90fedb — Filesystem access.
pkgs/go/[email protected]/host/host_linux.go:84 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3aba33364c06e17 — Filesystem access.
pkgs/go/[email protected]/host/host_openbsd.go:63 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c829eee7d7c97f2e — Filesystem access.
pkgs/go/[email protected]/host/host_solaris.go:104 
	b, err := os.ReadFile("/etc/release")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eaf5965723c33dc0 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:94 
		return os.ReadFile(fpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f2ef64479260f58 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:105 
	content, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f11408668bafde34 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:121 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aefa64fea18e81a3 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:149 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a30e9dfa54e3704c — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:234 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5fce3ca98e5c50ae — Environment-variable access.
pkgs/go/[email protected]/internal/common/common.go:352 
		value = os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b13a8c001dbed209 — Environment-variable access.
pkgs/go/[email protected]/internal/common/common.go:363 
	value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22d58c8131a25f61 — Filesystem access.
pkgs/go/[email protected]/internal/common/common_linux.go:27 
	f, err := os.Open(HostProcWithContext(ctx))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0aff3904b1bb6ce0 — Filesystem access.
pkgs/go/[email protected]/load/load_linux.go:79 
	out, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09d7286191c5d8d2 — Filesystem access.
pkgs/go/[email protected]/load/load_linux.go:121 
	line, err := os.ReadFile(loadavgFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #725492b1d2771589 — Filesystem access.
pkgs/go/[email protected]/mem/mem_linux.go:476 
	f, err := os.Open(swapsFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c936de04bc412c96 — Environment-variable access.
pkgs/go/[email protected]/mem/mem_plan9.go:20 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3314734945d160a — Environment-variable access.
pkgs/go/[email protected]/mem/mem_plan9.go:42 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75b1410c5ea28071 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:475 
	f, err := os.Open(dir)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8fee56a8a3e7411 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:518 
	d, err := os.Open(common.HostProcWithContext(ctx))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b869333b5129be0 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:562 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4996af4492319bc5 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:681 
	contents, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85821094e540e5c8 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:742 
	contents, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc8c341a8a688e8f — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:139 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d528bcf17f5285a — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:348 
		statContents, err := os.ReadFile(statFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c915eb2b10ed962 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:399 
	contents, err := os.ReadFile(smapsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60cdbe9414085184 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:494 
	environContent, err := os.ReadFile(environPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4ecc670949494a2 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:521 
	d, err := os.Open(limitsFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8272fd1dcf63c04e — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:614 
	d, err := os.Open(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02296bcca1cd1a6b — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:678 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0b85c55e2bf24b9 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:692 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15967cff38e6bba3 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:715 
	ioline, err := os.ReadFile(ioPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #223df5ebcede16ec — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:755 
	contents, err := os.ReadFile(memPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf1fd85353d81dc1 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:816 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efeead21264585e4 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:833 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4b04863d6619794 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:1040 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8664f6f6aa9cc8df — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:1168 
	d, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2444943889454b3 — Filesystem access.
pkgs/go/[email protected]/process/process_posix.go:31 
	d, err := os.Open(devPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ae6292b018cead6 — Filesystem access.
pkgs/go/[email protected]/process/process_posix.go:49 
	ptsd, err := os.Open(ptsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bdfd742c5411edb9 — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:203 
	d, err := os.Open(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af6fa2fe9787710b — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:235 
	exe, err := os.ReadFile(execNamePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c77c56a49719778f — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:245 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2855696634628c5e — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:259 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8edd975d7e16698e — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:281 
	d, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #248d93b3b8face52 — Filesystem access.
pkgs/go/[email protected]/sensors/ex_linux.go:52 
		if raw, _ = os.ReadFile(basepath + "_label"); len(raw) != 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dfc5a83b365be8c — Filesystem access.
pkgs/go/[email protected]/sensors/ex_linux.go:58 
		if raw, err = os.ReadFile(filepath.Join(directory, "name")); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #156165438023898d — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:39 
			name, err := os.ReadFile(filepath.Join(file, "type"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e3581890b64d531 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:45 
			current, err := os.ReadFile(filepath.Join(file, "temp"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7f42ed25becca57 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:89 
		if raw, _ = os.ReadFile(basepath + "_label"); len(raw) != 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0896d493f9d15fd — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:95 
		if raw, err = os.ReadFile(filepath.Join(directory, "name")); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30f2af1a13bdf58e — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:107 
		if raw, err = os.ReadFile(file); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a9306b262635f0c — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:163 
	if raw, err = os.ReadFile(filename); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/spf13/cobra

go dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #b5f50c3be4baf20a — Environment-variable access.
pkgs/go/[email protected]/active_help.go:48 
	activeHelpCfg := os.Getenv(activeHelpGlobalEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75920d5e4e88bcd5 — Environment-variable access.
pkgs/go/[email protected]/active_help.go:50 
		activeHelpCfg = os.Getenv(activeHelpEnvVar(cmd.Root().Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a4973ba68fcaf8c — Filesystem access.
pkgs/go/[email protected]/bash_completions.go:702 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #694893d863297f3a — Filesystem access.
pkgs/go/[email protected]/bash_completionsV2.go:471 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d10877587ab5ebee — Environment-variable access.
pkgs/go/[email protected]/completions.go:957 
	if path := os.Getenv("BASH_COMP_DEBUG_FILE"); path != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #936bed5337cf3178 — Filesystem access.
pkgs/go/[email protected]/completions.go:958 
		f, err := os.OpenFile(path,
			os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43b1acb5d728ae07 — Environment-variable access.
pkgs/go/[email protected]/completions.go:1015 
	v := os.Getenv(configEnvVar(cmd.Root().Name(), suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a53cb9480386b0f — Environment-variable access.
pkgs/go/[email protected]/completions.go:1017 
		v = os.Getenv(configEnvVar(configEnvVarGlobalPrefix, suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25964ba9f024fae5 — Filesystem access.
pkgs/go/[email protected]/doc/man_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c24828f4f0cec6e — Environment-variable access.
pkgs/go/[email protected]/doc/man_docs.go:127 
		if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d228c015c0da7d6d — Filesystem access.
pkgs/go/[email protected]/doc/md_docs.go:145 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78c1f7fbfefce48a — Filesystem access.
pkgs/go/[email protected]/doc/rest_docs.go:157 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ce4400c38200bda — Filesystem access.
pkgs/go/[email protected]/doc/yaml_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcd74e2fb0b13ac9 — Filesystem access.
pkgs/go/[email protected]/fish_completions.go:285 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58e8c3594114346b — Filesystem access.
pkgs/go/[email protected]/powershell_completions.go:321 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a001670fc5238d12 — Filesystem access.
pkgs/go/[email protected]/zsh_completions.go:71 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/sys

go dependency
expand_more 59 low-confidence finding(s)
low env_fs dependency Excluded from app score #20610708050dec59 — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu.go:271 
	env := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eec1eddb100ea4ed — Filesystem access.
pkgs/go/[email protected]/cpu/hwcap_linux.go:42 
	buf, err := os.ReadFile(procAuxv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f9e348df7af9e1b — Filesystem access.
pkgs/go/[email protected]/cpu/proc_cpuinfo_linux.go:17 
	f, err := os.Open("/proc/cpuinfo")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29c7c7f2c2d33f3c — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:90 
	goos := os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc1e91758090db8f — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:91 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17e2592d0d93408d — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:93 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a60e99838c62d6f6 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:98 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb4b5a64037fd251 — Filesystem access.
pkgs/go/[email protected]/plan9/mksyscall.go:127 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66a20786d4289f31 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:443 
		src, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccf3b7ea33c1b4f2 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:467 
	f, err := os.Create(mergedFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80b41a41e14082a6 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:494 
		err = os.WriteFile(inFile.name, src, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c9750bd67e9f299 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:182 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f95bdfa81f681168 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:317 
	if fmtCmd.Stdout, err = os.Create(outputFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7b9bea13d6decc9 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:337 
	t.env = append(os.Environ(), fmt.Sprintf("%s=%s", "GOOS", GOOS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f909af37036a1840 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:447 
	if file, err := os.Create(stubsFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fc78fa88420e3bc — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:482 
	abiFile, err := os.Create(filepath.Join(abiDir, "abi.h"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8363551d407551a — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:631 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cd49ff95ca5fcae — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:756 
	f, err := os.Create(fmt.Sprintf("zptrace_%s_linux.go", archName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be189f97bb69610a — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:784 
	f, err := os.Create(fmt.Sprintf("zptrace_linux_%s.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e05e0ee2f074069 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:819 
	data, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f566ebb8150be549 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:100 
	goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56ea2a47ee43d803 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:101 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64813e055c402fa5 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:103 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e50f52f71b814845 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:111 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98e962ac9c7a4fdb — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:117 
	cc := os.Getenv("CC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06de99e0b511df0b — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:36 
		in, err := os.ReadFile(inFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5c82b5e8b1c8295 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:73 
	if err := os.WriteFile(outFileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a30366a1b8d8349 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:110 
	if err := os.WriteFile(fileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ea499bebd6900f3 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:26 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ea8d29716aab672 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:28 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f5bbc9896a36ff4 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:30 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2deb7caffe9f6a9e — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:32 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50325703458bd9d2 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:36 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2a223a465fa070f — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:104 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b50eb453ccd36c6 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:106 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a46d0dff3e2307a8 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:115 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a5a04b5b4dbf8ef — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall.go:145 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0712dc38543f3ac1 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc.go:100 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ade6dde3077c5fa — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:148 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab2df315a76c4595 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:521 
	err := os.WriteFile("zsyscall_aix_ppc64.go",
		[]byte(fmt.Sprintf(srcTemplate1, cmdLine(), goBuildTags(), pack, imp, textcommon)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d37842b9beda92a — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:532 
	err = os.WriteFile("zsyscall_aix_ppc64_gc.go",
		[]byte(fmt.Sprintf(srcTemplate2, cmdLine(), goBuildTags(), pack, imp, dynimports, linknames, vardecls, textgc)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba9aa41fb8a3ae03 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:541 
	err = os.WriteFile("zsyscall_aix_ppc64_gccgo.go",
		[]byte(fmt.Sprintf(srcTemplate3, cmdLine(), goBuildTags(), pack, cExtern, imp, textgccgo)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02874c22334d550d — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_solaris.go:103 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bed6408af0dd535a — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:208 
	f, err := os.Open(*inputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #948ddb61298d0b77 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:216 
	fasm, asmerr := os.Create(*outasm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e10194b9076d6306 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:230 
	fgo, goerr := os.Create(*outputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b3df91d18de5568 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:272 
	f, err := os.Create(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bac57f93ce709911 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:122 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02e47695001dd6e2 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:124 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec7c2ae95ded9fda — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:127 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ef349dafd574999 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:129 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f2bec77404b1381 — Filesystem access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:259 
		file, err := os.Open(filepath.Join("/usr/include", header))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #099a48ba1d673ad6 — Filesystem access.
pkgs/go/[email protected]/unix/mksysnum.go:70 
	file, err := os.Open(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22c774a31673b397 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:90 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77e033d7e27d005c — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:92 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58137a1952a2fe18 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:95 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #119a4dc691fd7d00 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:97 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12def48c4a884077 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:710 
	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ce262049f1a4888 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:894 
		err = os.WriteFile(*filename, data, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.