Close Open Privacy Scan

link https://github.com/vllm-project/vllm
bolt Snapshot: commit 8c13ee5
science engine v1.22
schedule 2026-07-24T19:07:37.149016+00:00

help Not analyzed — coverage too low to judge

Too little of this repository was analyzed to judge — 2/100 dependencies were scanned. This is not a clean result; it means the scan could not run far enough to reach one.

smart_toy AI deps detected: openai — detected in dependencies, not a safety judgment.

App Privacy Score

— /100
Not analyzed — coverage too low

Coverage too low to score · 188 finding(s)

bar_chart Score Breakdown

telemetry −25
env_fs −3

list Scan Summary

0 high 0 medium 188 low
First-party packages: 7
Dependency packages: 0
Ecosystem: rust

swap_horiz Application data flows

Not enough of this repository was analyzed to look for application data flows. Absence of findings here is not evidence of a clean result.

</> First-Party Code

first-party (rust): rust/src/bench

rust first-party
expand_more 133 low-confidence finding(s)
low env_fs production #bea96a4c21dcce02 — Environment-variable access.
repo/rust/src/bench/src/backends/mod.rs:185 
    API_KEY.get_or_init(|| std::env::var("OPENAI_API_KEY").ok())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #3a7b4bb215388c8f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/backends/pooling.rs:161 
                        tracing::warn!(
                            backend = "vllm-rerank",
                            inputs = list.len(),
                            "rerank request has no documents"
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #036d21957687dddc — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/backends/pooling.rs:179 
                        tracing::warn!(
                            backend = "vllm-rerank",
                            dataset = "random",
                            "rerank request has an empty query; use the random-rerank dataset"
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #b700e2d3d4fb01ce — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:76 
                tracing::info!(host, addresses = ?ips, "pre-resolved benchmark endpoint DNS");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #0837ca30f90b5eb9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:81 
            tracing::warn!(host, error = %e.as_report(), "failed to pre-resolve benchmark endpoint DNS");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #c43d7150439426ef — Environment-variable access.
repo/rust/src/bench/src/benchmark.rs:123 
    if let Ok(api_key) = std::env::var("OPENAI_API_KEY") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2498a419369eff0f — Environment-variable access.
repo/rust/src/bench/src/benchmark.rs:298 
    if let Ok(api_key) = std::env::var("OPENAI_API_KEY") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #b8c1d8f4cb531228 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:350 
        tracing::info!(base_url = %config.base_url, "fetching first model from server");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #9f8adf6b3313b939 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:353 
        tracing::info!(
            model_name = name,
            model_id = id,
            "selected first model from server"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #89fc8eb3ac5366e2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:366 
        tracing::info!(tokenizer = tid, "loading tokenizer");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4b11371beb9e6519 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:429 
    tracing::info!(
        dataset = ?config.dataset_name,
        prompts = config.num_prompts,
        description = %dataset_label,
        "generating benchmark dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #80fa786f1eb56f90 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:623 
    tracing::info!(
        prompts = input_requests.len(),
        elapsed_seconds = gen_elapsed.as_secs_f64(),
        "generated benchmark dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ea2878eac3a77e78 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:632 
        tracing::info!(
            filtered_prompts = filtered_count,
            max_model_len = config.max_model_len.unwrap(),
            "filtered prompts above maximum model length"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4442d0998bcc81d4 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:686 
        tracing::info!("starting initial single-prompt test run");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #1abc5f27fad23e64 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:701 
        tracing::info!("initial single-prompt test run completed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6ccdebb4b81d1a12 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:719 
        tracing::info!(
            reason = "prompt_token_ids",
            "skipping server tokenizer verification"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f2c50bc0df0ec590 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:727 
            tracing::info!(reason = "cached", "skipping server tokenizer verification");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #0671708dc33eb56b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:742 
                    tracing::info!("tokenizer sample verification passed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #02a0f9edda822cb9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:746 
                    tracing::warn!(
                        reason = %reason,
                        "server tokenizer unavailable; skipping prompt verification"
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a83b0cf626a9fed2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:752 
                    tracing::warn!("tokenizer sample mismatch; verifying and fixing all prompts");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6085a6d39d8689dd — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:764 
                            tracing::info!(
                                prompts = input_requests.len(),
                                "verified exact prompt token lengths"
                            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ea91825a796783e1 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:771 
                            tracing::warn!(
                                reason = %reason,
                                "server tokenizer became unavailable; using client token counts"
                            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8279b95863745494 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:785 
        tracing::info!(requests = config.num_warmups, "starting benchmark warmup");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #0d44bc8abc0de7a7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:798 
        tracing::info!(requests = config.num_warmups, "benchmark warmup completed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #2f4a45901564aa49 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:836 
        tracing::info!("detected speculative decoding; collecting metrics");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #851de35919102d8d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:845 
    tracing::info!(
        request_rate = config.request_rate,
        burstiness = config.burstiness,
        distribution,
        max_concurrency = config.max_concurrency.unwrap_or(config.num_prompts),
        prompts = config.num_prompts,
        "starting main benchmark run"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d87e35d71c01d07a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:863 
        tracing::info!(
            adapters = modules.len(),
            names = ?names,
            assignment = ?config.lora_assignment,
            "assigned LoRA adapters"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a82c2260c281692d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1141 
            tracing::error!(error = %e.as_report(), "profiler background task failed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #738762933d6fcc9f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1306 
    tracing::info!(url = %profile_url, "starting profiler");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e17089a59e64514b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1308 
        Ok(true) => tracing::info!(url = %profile_url, "profiler started"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #632a3d4f6d5e870e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1309 
        Ok(false) => tracing::warn!(url = %profile_url, "profiler start request was unsuccessful"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5b64ef15c171d826 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1311 
            tracing::warn!(url = %profile_url, error = %e.as_report(), "failed to start profiler")

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ffa84fc73a32fd5d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1323 
    tracing::info!(url = %profile_url, "stopping profiler");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #1064c36ecbac77c1 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1325 
        Ok(true) => tracing::info!(url = %profile_url, "profiler stopped"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e196ce8add274e21 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1326 
        Ok(false) => tracing::warn!(url = %profile_url, "profiler stop request was unsuccessful"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #9f9264a00a7bdb91 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1328 
            tracing::warn!(url = %profile_url, error = %e.as_report(), "failed to stop profiler")

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #3e68dac2b60bb602 — Environment-variable access.
repo/rust/src/bench/src/benchmark.rs:1346 
    if let Ok(api_key) = std::env::var("OPENAI_API_KEY") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #d2d85a424c4787b0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1391 
    tracing::info!(
        threshold,
        duration_seconds = duration_secs,
        "waiting for profiler batch threshold"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5a38c092e8f5793c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1401 
            tracing::info!(
                running_requests = running,
                threshold,
                "profiler batch threshold reached"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6022741e2a8f2ffe — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1423 
        Ok(true) => tracing::info!(url = %start_url, "profiler started"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #53bda04f366e086a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1425 
            tracing::warn!(url = %start_url, "profiler start request was unsuccessful");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #5e259fe4af18092d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1429 
            tracing::warn!(url = %start_url, error = %e.as_report(), "failed to start profiler");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f202affbc4dc524d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1444 
        Ok(true) => tracing::info!(url = %stop_url, "profiler stopped after capture"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ad2a427bfe4fb2e7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1445 
        Ok(false) => tracing::warn!(url = %stop_url, "profiler stop request was unsuccessful"),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #aab0da46b517bd2a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1447 
            tracing::warn!(url = %stop_url, error = %e.as_report(), "failed to stop profiler")

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #c2ea87b48e28e7d3 — Environment-variable access.
repo/rust/src/bench/src/benchmark.rs:1467 
    let api_key = Arc::new(std::env::var("OPENAI_API_KEY").ok());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #55d4d66ec5b451ac — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1529 
                        tracing::warn!(
                            prompt_index = i,
                            extra_tokens = excess,
                            adjusted_target = expected_input_len.saturating_sub(excess),
                            "server consistently adds prompt tokens; compensating verification target"
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #c7c26f2d05d231e5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1591 
        tracing::info!(
            fixed_prompts = fc,
            "fixed prompt lengths using server tokenizer"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #55626b458ffcba48 — Filesystem access.
repo/rust/src/bench/src/benchmark.rs:1818 
    let _ = std::fs::write(dir.join(cache_key), "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #27ba32955c08c13c — Environment-variable access.
repo/rust/src/bench/src/benchmark.rs:1847 
    let api_key = std::env::var("OPENAI_API_KEY").ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #a7148465a884ea25 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1849 
    tracing::info!(sample_size, "sampling prompts for tokenizer verification");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #eec1d20a8b2016df — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/benchmark.rs:1872 
            tracing::warn!(
                prompt_index = i,
                expected_tokens = expected,
                actual_tokens = tokens.len(),
                "tokenizer verification sample mismatch"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #e368592491efbb97 — Filesystem access.
repo/rust/src/bench/src/compare.rs:274 
    let content = std::fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #da5ef79ee66eeda0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/config.rs:299 
                        tracing::warn!(
                            value_type,
                            "sampling parameters may be lost because --extra-body is not a JSON object"
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ec02dc93ca91cb7a — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/config.rs:500 
                tracing::warn!(
                    dataset = "custom",
                    "client-side chat template rendering is unsupported; sending prompts raw"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #3472dc525eb6b7d3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/config.rs:581 
                tracing::warn!(
                    ignore_eos,
                    multi_turn = true,
                    "output length limits may be ignored, causing unbounded context growth"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #3ddf0296f17cae7b — Filesystem access.
repo/rust/src/bench/src/datasets/custom.rs:46 
    let content = std::fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b1754cdee3df186c — Filesystem access.
repo/rust/src/bench/src/datasets/custom.rs:125 
        std::fs::write(&path, content).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3d12726db7a578f8 — Environment-variable access.
repo/rust/src/bench/src/datasets/hf_dataset.rs:124 
    if let Ok(token) = std::env::var("HF_TOKEN") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #9996ec6f033b0b13 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:207 
    tracing::info!(
        dataset,
        config = resolved_config,
        split = resolved_split,
        "resolved Hugging Face dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d6c50225516aa76b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:226 
        tracing::info!(dataset, path = %path_str, "using cached Hugging Face dataset");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #c85a5ee125c2b375 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:230 
    tracing::info!(
        dataset,
        config = resolved_config,
        split = resolved_split,
        "downloading Hugging Face dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #0e7c6a04c1dd5180 — Filesystem access.
repo/rust/src/bench/src/datasets/hf_dataset.rs:294 
    std::fs::write(&cache_path, &json_str)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #aabeb6ead7282d47 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:297 
    tracing::info!(
        dataset,
        rows = all_rows.len(),
        path = %path_str,
        "saved Hugging Face dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #793ba55a74f3ea66 — Filesystem access.
repo/rust/src/bench/src/datasets/hf_dataset.rs:487 
    let content = std::fs::read_to_string(dataset_path).map_err(|e| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #76af50eca949da98 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:507 
            tracing::info!(
                format = "chat",
                column = col,
                "detected Hugging Face dataset format"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #1758f4220ba9e863 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:517 
            tracing::info!(
                format = "text",
                prompt_column = prompt_col,
                output_column = output_col.as_deref().unwrap_or("none"),
                "detected Hugging Face dataset format"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #b2f0aaf78f6f39d6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:525 
            tracing::info!(
                format = "combined",
                prompt_columns = ?cols,
                output_column = output_col.as_deref().unwrap_or("none"),
                "detected Hugging Face dataset format"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8dffac9cfc22d841 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:640 
                    tracing::warn!(
                        path = dataset_path,
                        default_output_tokens = 128,
                        "no dataset output column or --hf-output-len; using default output length"
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8393b9529667dcf5 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:651 
                tracing::warn!(
                    path = dataset_path,
                    default_output_tokens = 128,
                    "no dataset output column or --hf-output-len; using default output length"
                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #84402b3925c9672e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:674 
            tracing::info!(
                dataset = "hf",
                samples = samples.len(),
                requested = num_requests,
                "skipping dataset oversampling"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #16bd222f75efb990 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/hf_dataset.rs:688 
            tracing::info!(
                dataset = "hf",
                original_samples = original_len,
                samples = samples.len(),
                "oversampled dataset"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #df4847130503e844 — Filesystem access.
repo/rust/src/bench/src/datasets/hf_dataset.rs:1049 
        std::fs::write(&path, serde_json::to_string(data).unwrap()).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #17fefad7a7145413 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/mod.rs:94 
        tracing::info!(
            samples = requests.len(),
            requested = num_requests,
            "skipping dataset oversampling"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8979952954f8a2b2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/mod.rs:108 
    tracing::info!(
        original_samples = original_len,
        samples = requests.len(),
        "oversampled dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #c14d2ce9bcbf926e — Filesystem access.
repo/rust/src/bench/src/datasets/multi_turn.rs:340 
    let content = std::fs::read_to_string(dataset_path).map_err(|e| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #01c0162ccaa86e68 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/multi_turn.rs:448 
        tracing::info!(
            original_conversations = original_len,
            conversations = conversations.len(),
            "oversampled multi-turn conversations"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #95d2616a01a11ae9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/prefix_repetition.rs:44 
        tracing::info!(
            requested = num_requests,
            generated = total,
            prefixes = num_prefixes,
            prompts_per_prefix,
            dropped = num_requests - total,
            "adjusted prefix-repetition request count"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #152fcdd52d4c356b — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/progress.rs:42 
            tracing::info!(rows, total, "fetching dataset rows");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #17e4105cc1d40e19 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/random.rs:52 
        tracing::info!(
            input_low,
            input_high,
            output_low,
            output_high,
            "sampling random request lengths"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ba7c848640c6b065 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/sharegpt.rs:26 
    tracing::info!(
        repository = DEFAULT_SHAREGPT_REPO,
        file = DEFAULT_SHAREGPT_FILE,
        "downloading ShareGPT dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #cb1460fd720a4ab7 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/sharegpt.rs:39 
    tracing::info!(dataset = "sharegpt", path = %path_str, "dataset is ready");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #1a59250c2a1f6a36 — Filesystem access.
repo/rust/src/bench/src/datasets/sharegpt.rs:57 
    let content = std::fs::read_to_string(dataset_path).map_err(|e| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #1e1379ce40a207a6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/sharegpt.rs:141 
            tracing::info!(
                dataset = "sharegpt",
                samples = samples.len(),
                requested = num_requests,
                "skipping dataset oversampling"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #adf2fad0d5465cc3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/sharegpt.rs:155 
            tracing::info!(
                dataset = "sharegpt",
                original_samples = original_len,
                samples = samples.len(),
                "oversampled dataset"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #f99af75dd6216ce1 — Filesystem access.
repo/rust/src/bench/src/datasets/sonnet.rs:45 
        Some(path) => std::fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #7ee50474fde3da5c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/speed_bench.rs:39 
        tracing::info!(config = config_name, path = %path_str, "using cached SPEED-Bench dataset");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4fa8a0658ed929ed — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/speed_bench.rs:43 
    tracing::info!(config = config_name, "downloading SPEED-Bench dataset");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #a28e4612d4d78a94 — Filesystem access.
repo/rust/src/bench/src/datasets/speed_bench.rs:139 
    std::fs::write(&cache_path, &json_str)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #c9525bd653a7c414 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/speed_bench.rs:142 
    tracing::info!(
        config = config_name,
        rows = all_rows.len(),
        path = %path_str,
        "saved SPEED-Bench dataset"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #ee85a05e639fc81c — Filesystem access.
repo/rust/src/bench/src/datasets/speed_bench.rs:167 
    let content = std::fs::read_to_string(dataset_path).map_err(|e| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #1ceb7ad9ea52dc5c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/speed_bench.rs:270 
            tracing::info!(
                dataset = "speed-bench",
                samples = samples.len(),
                requested = num_requests,
                "skipping dataset oversampling"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #099b999546c04ac3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/speed_bench.rs:284 
            tracing::info!(
                dataset = "speed-bench",
                original_samples = original_len,
                samples = samples.len(),
                "oversampled dataset"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e9cebe54473a7eb0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/datasets/speed_bench.rs:307 
    tracing::info!(categories = %cat_str.join(", "), "computed SPEED-Bench category distribution");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #23f3d0e5b9bfc9d6 — Environment-variable access.
repo/rust/src/bench/src/hub.rs:25 
        if let Ok(token) = std::env::var("HF_TOKEN") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #33b8ae0ac7a72e2e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/lib.rs:36 
        tracing::info!(soft_limit = new, "raised open-file limit");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #672cd472a857c599 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/metrics/calculator.rs:16 
    tracing::warn!(
        failed_requests = failed_outputs.len(),
        displayed_errors = failed_outputs.len().min(10),
        "benchmark requests failed"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a7cedbd005893b8e — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/metrics/calculator.rs:22 
        tracing::warn!(index, error = %output.error, "benchmark request failed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #7fd7642524ba1b61 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:76 
        tracing::info!(base_url = %config.base_url, "fetching first model from server");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #9b09f80e25b5a9af — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:78 
        tracing::info!(
            model_name = name,
            model_id = id,
            "selected first model from server"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #2ca7ed012ba4f801 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:91 
        tracing::info!(tokenizer = tid, "loading tokenizer");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d9beb23fa324aeab — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:99 
    tracing::info!(
        dataset = ?config.dataset_name,
        conversations = config.num_prompts,
        "generating multi-turn conversations"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #a93559e11ce0f9c1 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:191 
            tracing::info!(
                filtered_turns,
                filtered_conversations,
                max_model_len,
                "filtered conversations above maximum model length"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #88afa92402e00114 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:207 
    tracing::info!(
        conversations = conversations.len(),
        total_turns,
        elapsed_seconds = gen_elapsed.as_secs_f64(),
        "generated multi-turn conversations"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #254082e025ce71d6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:223 
        tracing::info!(
            global_ratio = config.multi_turn_prefix_global_ratio,
            global_tokens,
            conversation_ratio = config.multi_turn_prefix_conversation_ratio,
            conversation_tokens = conv_tokens,
            unique_tokens,
            history_accumulation = false,
            "configured multi-turn prefix sharing"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #7a9e4fb65353a1f3 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:265 
        tracing::info!("starting initial single-prompt test run");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #4cefd4dfba104314 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:280 
        tracing::info!("initial single-prompt test run completed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #398a319da257a26d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:295 
            tracing::info!(
                min_tokens = config.random_output_len,
                dataset = "random",
                "set minimum output tokens for multi-turn dataset"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #8eb2d56ae0991f30 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:310 
        tracing::info!("detected speculative decoding; collecting metrics");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #29c95371c9edd2c1 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:343 
    tracing::info!(
        conversations = conversations.len(),
        total_turns,
        concurrency,
        inter_turn_delay_ms = config.multi_turn_delay_ms,
        "starting multi-turn benchmark"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #d42baaecc5fdb2e2 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:380 
        tracing::info!(
            adapters = modules.len(),
            names = ?names,
            assignment = ?config.lora_assignment,
            scope = "conversation",
            "assigned LoRA adapters"
        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #257a7113d3fd04eb — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:450 
                tracing::error!(error = %e.as_report(), "conversation task panicked");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #51d3e716faa2c5eb — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/multi_turn.rs:470 
            tracing::error!(error = %e.as_report(), "profiler background task failed");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #cd47cec1dc153861 — Environment-variable access.
repo/rust/src/bench/src/multi_turn.rs:764 
    if let Ok(api_key) = std::env::var("OPENAI_API_KEY") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9c66d96feac5ddd6 — Filesystem access.
repo/rust/src/bench/src/output/json.rs:605 
    std::fs::write(file_path, content)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #7170868e431c36de — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/output/json.rs:606 
    tracing::info!(path = file_path, "saved benchmark results");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #cda264398f6e56af — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/output/json.rs:621 
    tracing::info!(path = file_path, "appended benchmark results");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #57ce9144f721362f — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/ready_checker.rs:26 
    tracing::info!(
        timeout_seconds,
        retry_interval,
        "waiting for endpoint readiness"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e7fd5f2189cb1e8c — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/ready_checker.rs:61 
                    tracing::warn!(error = err_last_line, "endpoint is not ready");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #73b2a132644093c0 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/sweep.rs:19 
        tracing::info!(url = %url, "reset prefix cache");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #5f68e01f860477ea — Filesystem access.
repo/rust/src/bench/src/tiktoken.rs:44 
        let content = std::fs::read_to_string(model_path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #886fccb93ca4eac9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tiktoken.rs:202 
    tracing::info!(
        encoding,
        kind = "built-in-tiktoken",
        vocab_size,
        "loaded tokenizer"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #f6ed9261accab63d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tiktoken.rs:320 
    tracing::info!(
        model = model_id,
        base_tokens = num_base_tokens,
        special_tokens = all_special_tokens.len(),
        pattern = if pattern.is_some() {
            "custom"
        } else {
            "default"
        },
        "loading tiktoken model"
    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #ba0b29010da6ac70 — Filesystem access.
repo/rust/src/bench/src/tiktoken.rs:342 
    let content = std::fs::read_to_string(model_path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b87f8a3a071b9b0b — Filesystem access.
repo/rust/src/bench/src/tiktoken.rs:364 
    let content = std::fs::read_to_string(config_path).ok()?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cc16a07855b0b701 — Filesystem access.
repo/rust/src/bench/src/tiktoken.rs:401 
            std::fs::read_to_string(p)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32d47ec545a18f0e — Filesystem access.
repo/rust/src/bench/src/tiktoken.rs:416 
    let source = std::fs::read_to_string(&py_path).ok()?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #167baa20a1ed4c03 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tiktoken.rs:453 
                    tracing::debug!(
                        fragments = fragments.len(),
                        "extracted tiktoken pattern from Python source"
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #e91ecefdc4b05466 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tokenizer.rs:251 
            tracing::info!(
                model = model_id,
                kind = "local",
                vocab_size = tok.get_vocab_size(true),
                "loaded tokenizer"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #6ef6b6670d5bbccb — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tokenizer.rs:261 
            tracing::info!(
                model = model_id,
                error = %local_err.as_report(),
                "local tokenizer unavailable; trying tiktoken"
            );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #ee71e985e8bb3832 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tokenizer.rs:268 
                    tracing::info!(
                        model = model_id,
                        kind = "tiktoken",
                        vocab_size = tok.vocab_size(),
                        "loaded tokenizer"
                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #577eb97b0ad74619 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tokenizer.rs:279 
                        tracing::info!(
                            model = model_id,
                            error = %tiktoken_err.as_report(),
                            "tiktoken unavailable; trying server-side tokenization"
                        );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry production #1ddf8c436a472bbf — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/bench/src/tokenizer.rs:286 
                                tracing::info!(
                                    model = model_id,
                                    kind = "server",
                                    vocab_size = srv.cached_vocab_size,
                                    "loaded tokenizer"
                                );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

first-party (rust): rust/src/chat

rust first-party
expand_more 17 low-confidence finding(s)
low env_fs production #cd63a6b009c41353 — Filesystem access.
repo/rust/src/chat/src/backend/hf.rs:189 
        std::fs::write(path, content).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fcb3bad749538608 — Filesystem access.
repo/rust/src/chat/src/multimodal.rs:227 
        let text = fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d425b659174ffa06 — Filesystem access.
repo/rust/src/chat/src/multimodal.rs:237 
    let text = fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2bb4a91f15274236 — Filesystem access.
repo/rust/src/chat/src/multimodal.rs:293 
                let text = fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #56278e5be9cad372 — Filesystem access.
repo/rust/src/chat/src/multimodal/video.rs:193 
        std::fs::write(
            &config_path,
            serde_json::json!({
                "model_type": "qwen3_vl",
                "image_token_id": QWEN3_IMAGE_PAD_ID,
                "video_token_id": QWEN3_VIDEO_PAD_ID,
            })
            .to_string(),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #521778512ea12fe4 — Filesystem access.
repo/rust/src/chat/src/multimodal/video.rs:215 
        std::fs::write(&video_config_path, r#"{"size":{"shortest_edge":128}}"#).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f56b312ed987ed0 — Filesystem access.
repo/rust/src/chat/src/multimodal/video.rs:227 
        std::fs::write(
            &processor_config_path,
            r#"{"video_processor":{"size":{"shortest_edge":128}}}"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fdd18903c38f38d5 — Filesystem access.
repo/rust/src/chat/src/multimodal/video.rs:251 
        std::fs::write(&video_config_path, r#"{"size""#).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71a9c737fc20add9 — Environment-variable access.
repo/rust/src/chat/src/renderer/harmony/mod.rs:467 
    std::env::var(SYSTEM_START_DATE_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a439fd51cfd56f09 — Environment-variable access.
repo/rust/src/chat/src/renderer/harmony/mod.rs:483 
    std::env::var(HARMONY_SYSTEM_INSTRUCTIONS_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b99174ab7b6aaf7 — Filesystem access.
repo/rust/src/chat/src/renderer/hf/format.rs:287 
        fs::read_to_string(vllm_examples_dir().join(relative_path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a77626a9e1aad2d1 — Filesystem access.
repo/rust/src/chat/src/renderer/hf/template.rs:59 
    let content = fs::read_to_string(template_path).map_err(TemplateError::ReadTemplateFile)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21bb0f8f8461c831 — Filesystem access.
repo/rust/src/chat/src/renderer/hf/template.rs:251 
        fs::write(&path, "{{ messages }}").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #38a1a5eff579943d — Filesystem access.
repo/rust/src/chat/src/renderer/hf/template.rs:269 
        fs::write(&path, "{{ messages }}").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3eefbd3f388ad01d — Filesystem access.
repo/rust/src/chat/src/renderer/hf/template.rs:298 
        fs::write(&path, "\"{{ messages }}\"").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65af5aeaf5719d1b — Filesystem access.
repo/rust/src/chat/src/renderer/hf/template.rs:309 
        fs::write(&path, r#"{"chat_template":"{{ messages }}"}"#).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9e7ae488b08caa4b — Filesystem access.
repo/rust/src/chat/src/renderer/test_utils.rs:29 
    let fixture = fs::read_to_string(path).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (rust): rust/src/cmd

rust first-party
expand_more 6 low-confidence finding(s)
low env_fs production #9e4c2a741160ee95 — Environment-variable access.
repo/rust/src/cmd/src/cli.rs:359 
            && let Ok(api_key) = std::env::var("VLLM_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19bbd68f8d9868dc — Environment-variable access.
repo/rust/src/cmd/src/cli.rs:691 
    let preferred_base_path = std::env::var_os("VLLM_RPC_BASE_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry production #999290f127f300a6 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/src/cmd/src/cli/unsupported.rs:67 
    tracing::warn!("argument '{arg}' currently has no effect in Rust frontend, ignoring");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs production #09b7ed326325873e — Environment-variable access.
repo/rust/src/cmd/src/logging.rs:32 
        env::var("VLLM_LOGGING_LEVEL").ok().as_deref(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #feebd5b81a8f26df — Environment-variable access.
repo/rust/src/cmd/src/logging.rs:33 
        env::var("RUST_LOG").ok().as_deref(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #affb35cc1e3e1ffc — Environment-variable access.
repo/rust/src/cmd/src/main.rs:29 
    if env::var_os(TOKIO_WORKER_THREADS_ENV).is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (rust): rust/src/engine-core-client

rust first-party
expand_more 1 low-confidence finding(s)
low env_fs production #c5c5bb723ec46288 — Environment-variable access.
repo/rust/src/engine-core-client/src/runtime.rs:73 
    std::env::var(ZMQ_WORKER_THREADS_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (rust): rust/src/server

rust first-party
expand_more 8 low-confidence finding(s)
low env_fs production #ed7726017fdd03f4 — Environment-variable access.
repo/rust/src/server/build.rs:5 
    let manifest_dir = std::env::var("CARGO_MANIFEST_DIR").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8243c50458b821f1 — Environment-variable access.
repo/rust/src/server/src/routes.rs:36 
    std::env::var("VLLM_SERVER_DEV_MODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f251d70597354c09 — Environment-variable access.
repo/rust/src/server/src/routes.rs:43 
    std::env::var("VLLM_ALLOW_RUNTIME_LORA_UPDATING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c904af2ca01dec23 — Environment-variable access.
repo/rust/src/server/src/routes/lora.rs:42 
    let prefixes = std::env::var_os(RUNTIME_LORA_ALLOWED_PATH_PREFIXES_ENV)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09c04f77832b2540 — Filesystem access.
repo/rust/src/server/src/routes/tests.rs:570 
    fs::write(
        &config_path,
        r#"{"model_type":"qwen2_vl","image_token_id":151655}"#,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1de7a6347e1a4ec8 — Environment-variable access.
repo/rust/src/server/src/runtime.rs:33 
    if let Some(value) = std::env::var_os(REQUEST_WORKER_THREADS_ENV) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #08b61a33e9c959f7 — Environment-variable access.
repo/rust/src/server/src/server_info.rs:76 
    std::env::vars().filter(|(key, _)| is_public_vllm_env_key(key)).collect()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #15ff4d880e1cb79b — Filesystem access.
repo/rust/src/server/src/tls_tests.rs:82 
            std::fs::write(dir.path().join(name), contents).expect("write fixture");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (rust): rust/src/text

rust first-party
expand_more 5 low-confidence finding(s)
low env_fs production #a4e9652702e642dd — Filesystem access.
repo/rust/src/text/src/backend/hf/config.rs:279 
    let content = fs::read_to_string(path).map_err(|error| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1a949b2bc37e39e — Environment-variable access.
repo/rust/src/text/src/backend/hf/model_files.rs:320 
    if let Ok(token) = std::env::var(HF_TOKEN_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f9a9c0cd32d80b18 — Filesystem access.
repo/rust/src/text/src/backend/hf/model_files.rs:400 
        fs::write(dir.path().join("tokenizer.json"), "{}").expect("write tokenizer");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7e10f4626543cd28 — Filesystem access.
repo/rust/src/text/src/backend/hf/model_files.rs:401 
        fs::write(
            dir.path().join("tokenizer_config.json"),
            r#"{"tokenizer_class":"TokenizersBackend"}"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e7cce6dd6295d206 — Filesystem access.
repo/rust/src/text/src/backend/hf/model_files.rs:406 
        fs::write(dir.path().join("config.json"), "{}").expect("write config");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (rust): rust/src/tokenizer

rust first-party
expand_more 18 low-confidence finding(s)
low env_fs production #cbf71dd9a7053b2d — Filesystem access.
repo/rust/src/tokenizer/src/hf.rs:275 
        std::fs::write(
            dir.path().join("tokenizer_config.json"),
            r#"{
                "added_tokens_decoder": {
                    "9": {
                        "content": "<|image_pad|>",
                        "special": true,
                        "normalized": false
                    }
                }
            }"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #421bdf433d04be25 — Filesystem access.
repo/rust/src/tokenizer/src/hf/added_tokens.rs:61 
    let tokenizer_json = fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0482a52985d4c7b1 — Filesystem access.
repo/rust/src/tokenizer/src/hf/added_tokens.rs:88 
    let text = fs::read_to_string(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #129d9f9dbbfbf246 — Environment-variable access.
repo/rust/src/tokenizer/src/tiktoken.rs:262 
        if std::env::var_os(DISABLE_RIPTOKEN_ENV).is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #81d7eaa6b8576712 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:344 
        let content = std::fs::read_to_string(path).map_err(|error| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #097788ad00e3aa68 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:379 
                let content = std::fs::read_to_string(&config_path).ok()?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a0bcce3c51b7465 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:389 
                let content = std::fs::read_to_string(&config_path).ok()?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7ef905dfbca249a — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:564 
        fs::write(&path, content).expect("write tiktoken file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a7a79aee2bcc4d6c — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:585 
        fs::write(&path, content).expect("write sparse-rank tiktoken file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1446c129dcff9a62 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:650 
        fs::write(dir.path().join("config.json"), r#"{"vocab_size": 280}"#)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ce26ca74c8dce9ba — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:688 
        fs::write(dir.path().join("config.json"), r#"{"vocab_size": 1002}"#)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2ca4ddcac4d359b — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:716 
        fs::write(
            dir.path().join("tokenizer_config.json"),
            r#"{
                "added_tokens_decoder": {
                    "257": { "content": "<|im_end|>", "special": true },
                    "258": { "content": "<|tool_call_begin|>", "special": false }
                }
            }"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #011a49557bc931d4 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:726 
        fs::write(dir.path().join("config.json"), r#"{"vocab_size": 260}"#)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9a0fb0692521ede9 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:761 
        fs::write(
            dir.path().join("config.json"),
            r#"{"text_config": {"vocab_size": 270}}"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dd1f32de0690cf97 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:969 
        fs::write(
            dir.path().join("tokenizer_config.json"),
            r#"{
                "added_tokens_decoder": {
                    "257": { "content": "<think>", "special": false },
                    "258": { "content": "</think>", "special": false }
                }
            }"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a0cbb5dccf0deeb — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:979 
        fs::write(dir.path().join("config.json"), r#"{"vocab_size": 259}"#)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d74ff911cc65ac6d — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:998 
        fs::write(
            dir.path().join("tokenizer_config.json"),
            r#"{
                "added_tokens_decoder": {
                    "257": { "content": "<think>", "special": false }
                }
            }"#,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #48d873df9cae82f7 — Filesystem access.
repo/rust/src/tokenizer/src/tiktoken.rs:1007 
        fs::write(dir.path().join("config.json"), r#"{"vocab_size": 258}"#)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • anyhow prod — no version pinned
  • base64 prod — no version pinned
  • bytes prod — no version pinned
  • chrono prod — no version pinned
  • clap prod — no version pinned
  • dirs prod — no version pinned
  • futures prod — no version pinned
  • hf-hub prod — no version pinned
  • image prod — no version pinned
  • indicatif prod — no version pinned
  • mimalloc prod — no version pinned
  • rand prod — no version pinned
  • rand_distr prod — no version pinned
  • rayon prod — no version pinned
  • reqwest prod — no version pinned
  • rlimit prod — no version pinned
  • rustc-hash prod — no version pinned
  • serde prod — no version pinned
  • serde_json prod — no version pinned
  • thiserror prod — no version pinned
  • thiserror-ext prod — no version pinned
  • tiktoken-rs prod — no version pinned
  • tokenizers prod — no version pinned
  • tokio prod — no version pinned
  • tokio-stream prod — no version pinned
  • tracing prod — no version pinned
  • tracing-subscriber prod — no version pinned
  • url prod — no version pinned
  • uuid prod — no version pinned
  • asynk-strim-attr prod — no version pinned
  • easy-ext prod — no version pinned
  • half prod — no version pinned
  • indexmap prod — no version pinned
  • itertools prod — no version pinned
  • llm-multimodal prod — no version pinned
  • minijinja prod — no version pinned
  • minijinja-contrib prod — no version pinned
  • openai-harmony prod — no version pinned
  • reqwest-0-13 prod — no version pinned
  • serde-json-fmt prod — no version pinned
  • serde_with prod — no version pinned
  • strum prod — no version pinned
  • subenum prod — no version pinned
  • time prod — no version pinned
  • trait-set prod — no version pinned
  • vllm-engine-core-client prod — no version pinned
  • vllm-llm prod — no version pinned
  • vllm-parser prod — no version pinned
  • vllm-text prod — no version pinned
  • vllm-tokenizer prod — no version pinned
  • xgrammar-structural-tag prod — no version pinned
  • educe prod — no version pinned
  • native-tls-vendored prod — no version pinned
  • tokio-util prod — no version pinned
  • vllm-bench prod — no version pinned
  • vllm-chat prod — no version pinned
  • vllm-managed-engine prod — no version pinned
  • vllm-server prod — no version pinned
  • arc-swap prod — no version pinned
  • bytemuck prod — no version pinned
  • byteorder prod — no version pinned
  • enum-as-inner prod — no version pinned
  • hex prod — no version pinned
  • parking_lot prod — no version pinned
  • rmpv prod — no version pinned
  • serde_default prod — no version pinned
  • serde_repr prod — no version pinned
  • serde_tuple prod — no version pinned
  • task-local prod — no version pinned
  • vllm-metrics prod — no version pinned
  • libc prod — no version pinned
  • prometheus-client prod — no version pinned
  • winnow prod — no version pinned
  • pyo3 prod — no version pinned
  • pythonize prod — no version pinned
  • auto_enums prod — no version pinned
  • axum prod — no version pinned
  • http-body prod — no version pinned
  • hyper prod — no version pinned
  • hyper-util prod — no version pinned
  • openssl prod — no version pinned
  • prost prod — no version pinned
  • prost-types prod — no version pinned
  • sha2 prod — no version pinned
  • socket2 prod — no version pinned
  • subtle prod — no version pinned
  • tls-listener prod — no version pinned
  • tokio-openssl prod — no version pinned
  • tonic prod — no version pinned
  • tonic-health prod — no version pinned
  • tonic-prost prod — no version pinned
  • tower prod — no version pinned
  • tower-http prod — no version pinned
  • tracing-futures prod — no version pinned
  • validator prod — no version pinned
  • fastokens prod — no version pinned
  • riptoken prod — no version pinned
  • tekken prod — no version pinned