Close Open Privacy Scan

link https://github.com/streamlit/streamlit
bolt Snapshot: commit 5b2bbbe
science engine v1.22
schedule 2026-07-21T01:14:15.056308+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

App Privacy Score

82 /100
Low privacy risk

Low risk · 924 finding(s)

Dependency score: 82 (Low risk)

bar_chart Score Breakdown

egress −15
env_fs −3

list Scan Summary

0 high 2 medium 922 low
First-party packages: 2
Dependency packages: 23
Ecosystem: python

swap_horiz Application data flows

External domains: 30days.streamlit.appa-za.tile.openstreetmap.orgaccount.mapbox.comaccounts.google.comalembic.sqlalchemy.orgallthatsinteresting.comaltair-viz.github.ioapi.mapbox.comapps.mapbox.comarrow.apache.orgauth0.comaws.amazon.comb.tile.openstreetmap.orgbasemaps.cartocdn.combaseweb.designbit.lybitbucket.orgbl.ocks.orgbugs.python.orgbugs.webkit.orgcarto.comcartodb-basemaps-c.global.ssl.fastly.netcdn.jsdelivr.netcdn.plot.lycdnjs.cloudflare.comchart-studio.plotly.comchatgpt.comcheckip.amazonaws.comchromewebstore.google.comclick.palletsprojects.comcloud.google.comcode.activestate.comcode.google.comcollaboration.cmc.ec.gc.cacolor2k.comconsent.yahoo.comcran.r-project.orgcreativecommons.orgcx-oracle.readthedocs.iod3js.orgdata-apis.orgdata.iana.orgdata.jsdelivr.comdata.streamlit.iodata.un.orgdatabase.windows.netdatapackage.orgdatatracker.ietf.orgdate-fns.orgdeck.gldeckgl.readthedocs.iodemourl.libpathdeno.landdev.mysql.comdeveloper.android.comdeveloper.mozilla.orgdevelopers.google.comdiscuss.streamlit.iodoc-area-chart-steamgraph.streamlit.appdoc-area-chart.streamlit.appdoc-area-chart1.streamlit.appdoc-area-chart2.streamlit.appdoc-areachart-column.streamlit.appdoc-audio-column.streamlit.appdoc-audio-input-high-rate.streamlit.appdoc-audio-input.streamlit.appdoc-audio-purr.streamlit.appdoc-audio.streamlit.appdoc-badge.streamlit.appdoc-bar-chart-horizontal.streamlit.appdoc-bar-chart-unstacked.streamlit.appdoc-bar-chart.streamlit.appdoc-bar-chart1.streamlit.appdoc-bar-chart2.streamlit.appdoc-barchart-column.streamlit.appdoc-buton.streamlit.appdoc-button-icons.streamlit.appdoc-button-shortcuts.streamlit.appdoc-camera-input.streamlit.appdoc-chart-events-plotly-selection-state.streamlit.appdoc-chart-events-plotly-state.streamlit.appdoc-chart-events-vega-lite-state.streamlit.appdoc-chat-input-audio.streamlit.appdoc-chat-input-file-uploader.streamlit.appdoc-chat-input-inline.streamlit.appdoc-chat-input-session-state.streamlit.appdoc-chat-input.streamlit.appdoc-chat-message-user.streamlit.appdoc-chat-message-user1.streamlit.appdoc-checkbox-column.streamlit.appdoc-checkbox.streamlit.appdoc-code-ascii.streamlit.appdoc-code.streamlit.appdoc-color-picker.streamlit.appdoc-column.streamlit.appdoc-columns-borders.streamlit.appdoc-columns-bottom-widgets.streamlit.appdoc-columns-vertical-alignment.streamlit.appdoc-columns1.streamlit.appdoc-columns2.streamlit.appdoc-components-cleanup-function.streamlit.appdoc-components-custom-anchors.streamlit.appdoc-components-interactive-svg.streamlit.appdoc-components-markdown-links.streamlit.appdoc-components-tailwind-button.streamlit.appdoc-components-text-input.streamlit.appdoc-container1.streamlit.appdoc-container2.streamlit.appdoc-container3.streamlit.appdoc-container4.streamlit.appdoc-container5.streamlit.appdoc-data-editor-config.streamlit.appdoc-data-editor.streamlit.appdoc-data-editor1.streamlit.appdoc-dataframe-config-index.streamlit.appdoc-dataframe-config.streamlit.appdoc-dataframe-events-selection-state.streamlit.appdoc-dataframe-programmatic-selections.streamlit.appdoc-dataframe.streamlit.appdoc-dataframe1.streamlit.appdoc-date-column.streamlit.appdoc-date-input-empty.streamlit.appdoc-date-input.streamlit.appdoc-date-input1.streamlit.appdoc-datetime-column.streamlit.appdoc-datetime-input-empty.streamlit.appdoc-datetime-input.streamlit.appdoc-download-button-csv.streamlit.appdoc-download-button-deferred.streamlit.appdoc-download-button-file.streamlit.appdoc-download-button-text.streamlit.appdoc-empty-placeholder.streamlit.appdoc-empty.streamlit.appdoc-expander-callback.streamlit.appdoc-expander-conditional-outside.streamlit.appdoc-expander-lazy-load.streamlit.appdoc-expander.streamlit.appdoc-feedback-stars.streamlit.appdoc-feedback-thumbs.streamlit.appdoc-file-uploader-directory.streamlit.appdoc-file-uploader.streamlit.appdoc-form1.streamlit.appdoc-form2.streamlit.appdoc-fragment-balloons.streamlit.appdoc-fragment-rerun.streamlit.appdoc-fragment.streamlit.appdoc-graphviz-chart.streamlit.appdoc-header.streamlit.appdoc-html.streamlit.appdoc-image-column.streamlit.appdoc-image.streamlit.appdoc-json-column.streamlit.appdoc-json.streamlit.appdoc-line-chart.streamlit.appdoc-line-chart1.streamlit.appdoc-line-chart2.streamlit.appdoc-linechart-column.streamlit.appdoc-link-button.streamlit.appdoc-link-column.streamlit.appdoc-list-column.streamlit.appdoc-logo.streamlit.appdoc-map-color.streamlit.appdoc-map.streamlit.appdoc-markdown-column.streamlit.appdoc-markdown.streamlit.appdoc-menu-button.streamlit.appdoc-mermaid-chart.streamlit.appdoc-metric-example1.streamlit.appdoc-metric-example2.streamlit.appdoc-metric-example3.streamlit.appdoc-metric-example4.streamlit.appdoc-metric-example5.streamlit.appdoc-modal-dialog.streamlit.appdoc-multiselect-accept-new-options.streamlit.appdoc-multiselect-column-1.streamlit.appdoc-multiselect-column-2.streamlit.appdoc-multiselect.streamlit.appdoc-navigation-example-1.streamlit.appdoc-navigation-example-2.streamlit.appdoc-navigation-multipage-widgets.streamlit.appdoc-navigation-top.streamlit.appdoc-number-column.streamlit.appdoc-number-input-empty.streamlit.appdoc-number-input.streamlit.appdoc-page-link-query-params.streamlit.appdoc-page-link.streamlit.appdoc-pagination-dataframe.streamlit.appdoc-pagination.streamlit.appdoc-pills-multi.streamlit.appdoc-pills-single.streamlit.appdoc-plotly-chart-config.streamlit.appdoc-plotly-chart.streamlit.appdoc-popover-callback.streamlit.appdoc-popover-conditional-outside.streamlit.appdoc-popover-lazy-load.streamlit.appdoc-popover.streamlit.appdoc-popover2.streamlit.appdoc-progress-column.streamlit.appdoc-pydeck-chart.streamlit.appdoc-pydeck-event-state-selections.streamlit.appdoc-pyplot.streamlit.appdoc-radio-empty.streamlit.appdoc-radio.streamlit.appdoc-scatter-chart.streamlit.appdoc-scatter-chart1.streamlit.appdoc-scatter-chart2.streamlit.appdoc-segmented-control-multi.streamlit.appdoc-segmented-control-single.streamlit.appdoc-select-slider.streamlit.appdoc-selectbox-accept-new-options.streamlit.appdoc-selectbox-column.streamlit.appdoc-selectbox-empty.streamlit.appdoc-selectbox.streamlit.appdoc-skeleton-context.streamlit.appdoc-skeleton-standalone.streamlit.appdoc-slider.streamlit.appdoc-space-horizontal.streamlit.appdoc-space-vertical.streamlit.appdoc-spinner.streamlit.appdoc-status-exception.streamlit.appdoc-status-progress.streamlit.appdoc-status-toast.streamlit.appdoc-status-toast1.streamlit.appdoc-status-toast2.streamlit.appdoc-status-update.streamlit.appdoc-status.streamlit.appdoc-string.streamlit.appdoc-string1.streamlit.appdoc-string2.streamlit.appdoc-subheader.streamlit.appdoc-switch-page-query-params.streamlit.appdoc-switch-page.streamlit.appdoc-table-auto-header.streamlit.appdoc-table-confusion.streamlit.appdoc-table-hide-header-and-index.streamlit.appdoc-table-horizontal-border.streamlit.appdoc-tabs-callback.streamlit.appdoc-tabs-conditional-outside.streamlit.appdoc-tabs-lazy-load.streamlit.appdoc-tabs1.streamlit.appdoc-tabs2.streamlit.appdoc-tabs3.streamlit.appdoc-text-area.streamlit.appdoc-text-column.streamlit.appdoc-text-input.streamlit.appdoc-text.streamlit.appdoc-time-column.streamlit.appdoc-time-input-empty.streamlit.appdoc-time-input.streamlit.appdoc-title.streamlit.appdoc-toggle.streamlit.appdoc-vega-lite-chart.streamlit.appdoc-video-column.streamlit.appdoc-video-subtitle-inputs.streamlit.appdoc-video-subtitles.streamlit.appdoc-video.streamlit.appdoc-write-stream-data.streamlit.appdoc-write1.streamlit.appdoc-write2.streamlit.appdoc-write3.streamlit.appdocs.astral.shdocs.bodo.aidocs.mapbox.comdocs.microsoft.comdocs.pola.rsdocs.pytest.orgdocs.python.orgdocs.scipy.orgdocs.snowflake.comdocs.sqlalchemy.orgdocs.streamlit.iodownload.oracle.comduckdb.orgen.m.wikipedia.orgen.wikipedia.orgen.wikiversity.orgesm.shevents.mapbox.cnevents.mapbox.comexslt.orgextras.streamlit.appfc.yahoo.comfilesystem-spec.readthedocs.iofinance.yahoo.comfonts.google.comfonts.googleapis.comfonts.gstatic.comfonts.openmaptiles.orgforum.omz-software.comgeoserveis.icgc.catget.webgl.orggist.github.comgit-scm.comgithub.bloggithub.comgithub.github.comgoogle.comguce.yahoo.comhtml.spec.whatwg.orghttpbin.orgi.imgur.comi.redd.itissues.streamlit.appjse.amstat.orgjson-schema.orgkatex.orgkroki.iokubernetes.iolearn.microsoft.comlegacy.python.orglh3.googleusercontent.comlogin.microsoftonline.commagicstack.github.iomapbox.commaplibre.orgmarkets.businessinsider.commatplotlib.orgmdn.github.iomermaid.js.orgmomentjs.commsdn.microsoft.comnarwhals-dev.github.ionot.a.real.urlnpms.ionumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgopenid.netopensource.orgopenstreetmap.orgoracle.github.iopackaging.python.orgpandas.pydata.orgparquet.apache.orgpeps.python.orgpicsum.photosplot.lyplotly.compresbrey.mit.edupreview.redd.itprotobuf.devpymysql.readthedocs.iopyperclip.readthedocs.iopypi.orgpython-oracledb.readthedocs.ioquery1.finance.yahoo.comquery2.finance.yahoo.comraw.githubusercontent.comreact-window-8cygyvomv-brian-vaughns-projects.vercel.appreact-window-9gegorjnr-brian-vaughns-projects.vercel.appreact-window-btpcws98u-brian-vaughns-projects.vercel.appreact-window.vercel.appreact.devreactjs.orgrefspecs.linuxfoundation.orgrequests.readthedocs.iorico.codesroadmap.streamlit.apps3-us-west-2.amazonaws.comsass-lang.comschema.orgserver.arcgisonline.comsethmlarson.devshare-demo.streamlit.ioshare-head.streamlit.ioshare-staging.streamlit.ioshare.streamlit.iosites.google.comsome-prefix.comsourceforge.netspecifications.freedesktop.orgspecs.frictionlessdata.iosqlalche.mesqlite.orgstackoverflow.comstamen.comstatic.streamlit.iostorage.googleapis.comstreamlit-demo-data.s3-us-west-2.amazonaws.comstreamlit.iosupport.sas.comtc39.estc39.github.iotechnet.microsoft.comtechspot.zzzeek.orgtestnb.readthedocs.iotile.openstreetmap.orgtilemaps.icgc.cattiles-a.basemaps.cartocdn.comtiles-b.basemaps.cartocdn.comtiles-c.basemaps.cartocdn.comtiles-d.basemaps.cartocdn.comtiles.basemaps.cartocdn.comtiles.stadiamaps.comtools.ietf.orgtyping.readthedocs.iounpkg.comupload.wikimedia.orguse.typekit.netvega.github.ioweb.archive.orgwebsockets.readthedocs.iowerkzeug.palletsprojects.comwiki.openstreetmap.orgwww.apache.orgwww.esri.comwww.extremelycoolapp.comwww.freetds.orgwww.gevent.orgwww.glideapps.comwww.google.comwww.gossamer-threads.comwww.iana.orgwww.ietf.orgwww.mapbox.comwww.npmjs.comwww.openstreetmap.orgwww.opm.govwww.oracle.comwww.postgresql.orgwww.psycopg.orgwww.python.orgwww.rfc-editor.orgwww.sitemaps.orgwww.sqlite.orgwww.stata.comwww.statsmodels.orgwww.streamlit.iowww.typescriptlang.orgwww.w3.orgwww.w3schools.comwww.webmproject.orgwww.youtube.comwww.zetetic.netxarray.pydata.orgxlrd.readthedocs.ioyoutu.be

medium pyarrow A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:60 → pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:63
medium pyarrow A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:74 → pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:77

</> First-Party Code

first-party (python)

python first-party
expand_more 557 low-confidence finding(s)
low egress test-only Excluded from app score #78a365709bd67a25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/e2e_playwright/auth_test.py:69 
            response = requests.get(url, timeout=1)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #aff2e0fd7009b2ed — Environment-variable access.
repo/e2e_playwright/config_arrow_truncation_test.py:25 
    os.environ["STREAMLIT_SERVER_ENABLE_ARROW_TRUNCATION"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1e38ad09a1088529 — Environment-variable access.
repo/e2e_playwright/config_arrow_truncation_test.py:26 
    os.environ["STREAMLIT_SERVER_MAX_MESSAGE_SIZE"] = "3"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4a60349fdd5d2509 — Environment-variable access.
repo/e2e_playwright/config_arrow_truncation_test.py:28 
    del os.environ["STREAMLIT_SERVER_ENABLE_ARROW_TRUNCATION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #75e255a48290d07f — Environment-variable access.
repo/e2e_playwright/config_arrow_truncation_test.py:29 
    del os.environ["STREAMLIT_SERVER_MAX_MESSAGE_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9f2a701aaaea8c2a — Environment-variable access.
repo/e2e_playwright/conftest.py:229 
    env_raw_value = os.getenv(env_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f96e9409dfcb4929 — Environment-variable access.
repo/e2e_playwright/conftest.py:365 
            env={**os.environ.copy(), **self.env},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #bccd2588b457185f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/e2e_playwright/conftest.py:419 
            requests.get(f"http://{host}:{port}/_stcore/health", timeout=1).text == "ok"

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #fc2cdf4ebfc52956 — Environment-variable access.
repo/e2e_playwright/conftest.py:1322 
        pytestconfig.getoption("workerinput", None) or os.getenv("PYTEST_XDIST_WORKER"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2885d9ef2297cd69 — Environment-variable access.
repo/e2e_playwright/conftest.py:1790 
    env = {**os.environ.copy(), **(extra_env or {})}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #093f0bad35cccccd — Filesystem access.
repo/e2e_playwright/hostframe_app_test.py:39 
HOSTFRAME_TEST_HTML: Final[str] = (STATIC_DIR / "hostframe.html").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f3ee88cd0cee6057 — Filesystem access.
repo/e2e_playwright/iframe_resizer_test.py:36 
IFRAME_RESIZER_SCRIPT: Final[str] = (STATIC_DIR / "iframerResizer.min.js").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6acc066bd57aa1ad — Environment-variable access.
repo/e2e_playwright/load_testing/conftest.py:94 
                "runner": os.environ.get("GITHUB_RUNNER", "local"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5c84b33dc53adbe5 — Filesystem access.
repo/e2e_playwright/load_testing/conftest.py:102 
        with open(filepath, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ab9396d17716e96 — Environment-variable access.
repo/e2e_playwright/load_testing/conftest.py:202 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f9579b9e23e30fe — Filesystem access.
repo/e2e_playwright/load_testing/generate_report.py:46 
        with open(combined_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #657d67f150b2cf03 — Filesystem access.
repo/e2e_playwright/load_testing/generate_report.py:55 
        with open(filepath, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c87b17ff9ee213d — Filesystem access.
repo/e2e_playwright/load_testing/generate_report.py:76 
            with open(first_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb89eb56ba22a99a — Filesystem access.
repo/e2e_playwright/load_testing/generate_report.py:248 
    with open(args.output, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e6fd907ff4f8dfee — Environment-variable access.
repo/e2e_playwright/multipage_apps/mpa_configure_sidebar_test.py:30 
    os.environ["STREAMLIT_CLIENT_SHOW_SIDEBAR_NAVIGATION"] = "False"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dc2d3c8618d85836 — Environment-variable access.
repo/e2e_playwright/multipage_apps/mpa_configure_sidebar_test.py:32 
    del os.environ["STREAMLIT_CLIENT_SHOW_SIDEBAR_NAVIGATION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b3310243594e486b — Environment-variable access.
repo/e2e_playwright/multipage_apps/mpa_v2_custom_theme_test.py:29 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "#BB1010"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eeeaedaec61a08c6 — Environment-variable access.
repo/e2e_playwright/multipage_apps/mpa_v2_custom_theme_test.py:30 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#0E0E0E"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9d33384f4f356df9 — Environment-variable access.
repo/e2e_playwright/multipage_apps/mpa_v2_custom_theme_test.py:32 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5df2ce32a92e28ca — Environment-variable access.
repo/e2e_playwright/multipage_apps/mpa_v2_custom_theme_test.py:33 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92939b6deb14099c — Filesystem access.
repo/e2e_playwright/shared/performance.py:254 
        with open(
            os.path.join(performance_results_dir, f"{timestamp}_{test_name}.json"),
            "w",
            encoding="utf-8",
        ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e7040deefe2bec91 — Environment-variable access.
repo/e2e_playwright/shared/stats_reporter.py:128 
    return os.getenv("PYTEST_XDIST_WORKER", "primary")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f66414cad1b16b7 — Environment-variable access.
repo/e2e_playwright/shared/stats_reporter.py:416 
            "ci": os.getenv("CI", "false").lower() == "true",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a83ef31f561ef675 — Environment-variable access.
repo/e2e_playwright/shared/stats_reporter.py:417 
            "github_run_id": os.getenv("GITHUB_RUN_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64bc4dea506b9c91 — Environment-variable access.
repo/e2e_playwright/shared/stats_reporter.py:418 
            "github_sha": os.getenv("GITHUB_SHA"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aea068b6cd69f24f — Environment-variable access.
repo/e2e_playwright/shared/stats_reporter.py:419 
            "github_ref": os.getenv("GITHUB_REF"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3930af15c47c3fd — Filesystem access.
repo/e2e_playwright/shared/stats_reporter.py:569 
            with open(self.output_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #afa37f6a72bf748c — Filesystem access.
repo/e2e_playwright/skills_nudge_test.py:65 
    (streamlit_dir / "credentials.toml").write_text('[general]\nemail = ""\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #63f4a7d919266fea — Environment-variable access.
repo/e2e_playwright/st_app_advanced_script.py:90 
st.write(f"API Key from environ: {os.environ.get('api_key', 'NOT SET')}")  # noqa: SIM112

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #7821dcd6f09e398e — Hardcoded external endpoint. Review what data is sent to this destination.
repo/e2e_playwright/st_audio.py:28 
file = requests.get(url1).content

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0f65bfa24d311e4c — Hardcoded external endpoint. Review what data is sent to this destination.
repo/e2e_playwright/st_cache_data.py:71 
    file = requests.get(url).content

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #add52dbf2eba829b — Hardcoded external endpoint. Review what data is sent to this destination.
repo/e2e_playwright/st_cache_data.py:78 
    file = requests.get(url).content

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #782b609bb1e80e2c — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:40 
    os.environ["STREAMLIT_THEME_BASE"] = "dark"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ed4c0a143dd88cd1 — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:41 
    os.environ["STREAMLIT_THEME_RED_COLOR"] = "#ffb3b3"  # Pale pink-red

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ffadf7f6d042f18f — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:42 
    os.environ["STREAMLIT_THEME_ORANGE_COLOR"] = "#ffd9b3"  # Pale peach

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7c75f2c0639f494f — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:43 
    os.environ["STREAMLIT_THEME_YELLOW_COLOR"] = "#ffffb3"  # Pale cream

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c28a1aa89545219e — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:44 
    os.environ["STREAMLIT_THEME_GREEN_COLOR"] = "#b3ffb3"  # Pale mint

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6129615579bd6fa5 — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:45 
    os.environ["STREAMLIT_THEME_BLUE_COLOR"] = "#b3d9ff"  # Pale sky blue

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b4288fe72b811272 — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:46 
    os.environ["STREAMLIT_THEME_VIOLET_COLOR"] = "#d9b3ff"  # Pale lavender

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1463210179aab1a3 — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:47 
    os.environ["STREAMLIT_THEME_GRAY_COLOR"] = "#d9d9d9"  # Light silver

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #32a66a4f5d4786b2 — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:48 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#ffb3d9"  # Pale pink

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c1f45e2a19b58b2d — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:50 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4805255bfd2bf88f — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:51 
    del os.environ["STREAMLIT_THEME_RED_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b77aebe2f59dffcb — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:52 
    del os.environ["STREAMLIT_THEME_ORANGE_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d32fd30b3136a73e — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:53 
    del os.environ["STREAMLIT_THEME_YELLOW_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c5e564c909c5918e — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:54 
    del os.environ["STREAMLIT_THEME_GREEN_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1b8f2c303fec7b1c — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:55 
    del os.environ["STREAMLIT_THEME_BLUE_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0cad37ed357b4d1f — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:56 
    del os.environ["STREAMLIT_THEME_VIOLET_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #89004a46161fce5a — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:57 
    del os.environ["STREAMLIT_THEME_GRAY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #358163310fee291d — Environment-variable access.
repo/e2e_playwright/st_chart_builtin_colors_test.py:58 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #744060c51e01f23d — Filesystem access.
repo/e2e_playwright/st_dataframe_config.py:38 
    data = file_path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3b578268ff874446 — Filesystem access.
repo/e2e_playwright/st_dataframe_interactions_test.py:227 
    with open(download_path, encoding="UTF-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2242acd17630bb68 — Filesystem access.
repo/e2e_playwright/st_download_button.py:48 
with open(CAT_IMAGE, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #28dc2325c3954afe — Filesystem access.
repo/e2e_playwright/st_download_button_deferred_test.py:33 
    content = download.path().read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3bfd2ccb92eb7fe1 — Filesystem access.
repo/e2e_playwright/st_download_button_deferred_test.py:53 
    content = download.path().read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2c4b8c663fe756e1 — Filesystem access.
repo/e2e_playwright/st_download_button_deferred_test.py:72 
    content = download.path().read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #88ef0d5c8718ef75 — Filesystem access.
repo/e2e_playwright/st_download_button_deferred_test.py:103 
    assert download.path().read_text() == "No rerun content"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2c479727c9dada0b — Filesystem access.
repo/e2e_playwright/st_download_button_deferred_test.py:122 
    assert download.path().read_text() == "This is regular string data"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a5c68621e9496873 — Filesystem access.
repo/e2e_playwright/st_download_button_test.py:152 
    file_text = download.path().read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e9bf3a66894ec397 — Filesystem access.
repo/e2e_playwright/st_download_button_test.py:237 
    file_text = download.path().read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e4d4dc44c9770f45 — Filesystem access.
repo/e2e_playwright/st_download_button_test.py:324 
    assert download.path().read_text() == "Updated data"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ab048d0685363a5 — Environment-variable access.
repo/e2e_playwright/st_main_layout.py:20 
test_mode = os.environ.get("STREAMLIT_SIDEBAR_TEST_MODE", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #efd44af93200fbe7 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:31 
    os.environ["STREAMLIT_THEME_RED_COLOR"] = "#750000"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b173110cb21826f7 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:32 
    os.environ["STREAMLIT_THEME_GREEN_COLOR"] = "#008000"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ed03d45a63a1ceba — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:33 
    os.environ["STREAMLIT_THEME_GRAY_COLOR"] = "#525252"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8c3c6a0a2c964980 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:36 
    os.environ["STREAMLIT_THEME_RED_BACKGROUND_COLOR"] = "#ffc7c7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1908b36d68ec9171 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:37 
    os.environ["STREAMLIT_THEME_ORANGE_BACKGROUND_COLOR"] = "#fdae44"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9a82fe29c40e6690 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:38 
    os.environ["STREAMLIT_THEME_YELLOW_BACKGROUND_COLOR"] = "#fde992"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0e855d592886225b — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:39 
    os.environ["STREAMLIT_THEME_BLUE_BACKGROUND_COLOR"] = "#6495ED"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dbf206d46983c8fd — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:40 
    os.environ["STREAMLIT_THEME_GREEN_BACKGROUND_COLOR"] = "#9dc183"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #72d11056d19e81b8 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:41 
    os.environ["STREAMLIT_THEME_VIOLET_BACKGROUND_COLOR"] = "#9E7BB5"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #407044a6eefa6bdc — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:42 
    os.environ["STREAMLIT_THEME_GRAY_BACKGROUND_COLOR"] = "#A7A6BA"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fcb874f392665991 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:43 
    os.environ["STREAMLIT_THEME_SIDEBAR_RED_BACKGROUND_COLOR"] = "#9d2933"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4f0a9f1fa820e557 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:44 
    os.environ["STREAMLIT_THEME_SIDEBAR_ORANGE_BACKGROUND_COLOR"] = "#fed8b1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3e10b17a48ee3498 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:45 
    os.environ["STREAMLIT_THEME_SIDEBAR_YELLOW_BACKGROUND_COLOR"] = "#ffffe0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6cff15c387a51385 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:46 
    os.environ["STREAMLIT_THEME_SIDEBAR_BLUE_BACKGROUND_COLOR"] = "#87afc7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1cad184945dfb30e — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:47 
    os.environ["STREAMLIT_THEME_SIDEBAR_GREEN_BACKGROUND_COLOR"] = "#d8e4bc"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2a8e68b0dc9edea8 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:48 
    os.environ["STREAMLIT_THEME_SIDEBAR_VIOLET_BACKGROUND_COLOR"] = "#D8BFD8"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #630296ae40b316c1 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:49 
    os.environ["STREAMLIT_THEME_SIDEBAR_GRAY_BACKGROUND_COLOR"] = "#DCDCDC"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1e5fcd504b8643fe — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:51 
    del os.environ["STREAMLIT_THEME_RED_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b72843aa74185d47 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:52 
    del os.environ["STREAMLIT_THEME_GREEN_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #694ab95f4a7769c7 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:53 
    del os.environ["STREAMLIT_THEME_GRAY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #178a1c893f9e1c8c — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:54 
    del os.environ["STREAMLIT_THEME_RED_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7306d97c4a57e734 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:55 
    del os.environ["STREAMLIT_THEME_ORANGE_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0ac0d4c38198777f — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:56 
    del os.environ["STREAMLIT_THEME_YELLOW_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #13b27310bab76ce9 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:57 
    del os.environ["STREAMLIT_THEME_BLUE_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f98c9b9cc0cfa28c — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:58 
    del os.environ["STREAMLIT_THEME_GREEN_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #83808a3b6a41b2ba — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:59 
    del os.environ["STREAMLIT_THEME_VIOLET_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #11a66c5cb7725bc0 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:60 
    del os.environ["STREAMLIT_THEME_GRAY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0f474685fc372353 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:61 
    del os.environ["STREAMLIT_THEME_SIDEBAR_RED_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9bd1c2c6d3596ef4 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:62 
    del os.environ["STREAMLIT_THEME_SIDEBAR_ORANGE_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #43b8ae6bc32bf683 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:63 
    del os.environ["STREAMLIT_THEME_SIDEBAR_YELLOW_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1b6ee90f549e2e47 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:64 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BLUE_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d2cf0a00cc3b11cd — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:65 
    del os.environ["STREAMLIT_THEME_SIDEBAR_GREEN_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #76cea95598dc20d3 — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:66 
    del os.environ["STREAMLIT_THEME_SIDEBAR_VIOLET_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #586ab59873d72e7a — Environment-variable access.
repo/e2e_playwright/theming/custom_background_colors_test.py:67 
    del os.environ["STREAMLIT_THEME_SIDEBAR_GRAY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8f9244b9a8dc64eb — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:52 
    os.environ["STREAMLIT_THEME_BASE"] = "dark"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8aab32564b7c7772 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:53 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "14"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ae0e2794883ac688 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:54 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#004cbe"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b949befe81fe10ce — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:55 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "#bdc4d5"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #43b17ded56e1c2ca — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:58 
    os.environ["STREAMLIT_THEME_DARK_BACKGROUND_COLOR"] = "#191e24"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9a6dc9b61a305dd5 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:59 
    os.environ["STREAMLIT_THEME_DARK_SECONDARY_BACKGROUND_COLOR"] = "#0f161e"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #557f7114b44e1121 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:60 
    os.environ["STREAMLIT_THEME_DARK_BORDER_COLOR"] = "#293246"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b8855eb592ebebb5 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:61 
    os.environ["STREAMLIT_THEME_DARK_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c16dabc306d1436a — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:65 
    os.environ["STREAMLIT_THEME_DARK_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1f9d7cbe87e355b0 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:69 
    os.environ["STREAMLIT_THEME_DARK_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c14f43767e6abf2e — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:74 
    os.environ["STREAMLIT_THEME_SIDEBAR_TEXT_COLOR"] = "#091c36"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4b81be4bac4707cd — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:75 
    os.environ["STREAMLIT_THEME_SIDEBAR_BACKGROUND_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8986a2f02edad936 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:78 
    os.environ["STREAMLIT_THEME_SIDEBAR_SECONDARY_BACKGROUND_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f4c632d48bf5132e — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:81 
    os.environ["STREAMLIT_THEME_SIDEBAR_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4f1286508accbede — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:85 
    os.environ["STREAMLIT_THEME_SIDEBAR_DATAFRAME_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d9a2bdd8f5442f9e — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:90 
    os.environ["STREAMLIT_THEME_DARK_SIDEBAR_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e81e5a5037c65dac — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:93 
    os.environ["STREAMLIT_THEME_DARK_SIDEBAR_LINK_COLOR"] = "#CD1C18"  # chili red

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0b5361e8b2ad4bb2 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:95 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5e3ba8956001aed2 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:96 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e51242908b6e48bc — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:97 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #03ec4ac99ece38a1 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:98 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #54e2e164f67556e4 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:99 
    del os.environ["STREAMLIT_THEME_DARK_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #63ca2d35daeadedf — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:100 
    del os.environ["STREAMLIT_THEME_DARK_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e68d45bdc658ac01 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:101 
    del os.environ["STREAMLIT_THEME_DARK_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ccc5e0af3c91a7b1 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:102 
    del os.environ["STREAMLIT_THEME_DARK_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #482849e320f2b1b6 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:103 
    del os.environ["STREAMLIT_THEME_DARK_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6db1b889bc037728 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:104 
    del os.environ["STREAMLIT_THEME_DARK_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3ea44e290ffbe397 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:105 
    del os.environ["STREAMLIT_THEME_SIDEBAR_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #40e45210743ffdbb — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:106 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #555e0ed926e15827 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:107 
    del os.environ["STREAMLIT_THEME_SIDEBAR_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2969a60f98e83710 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:108 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4c71cdfd9655aa73 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:109 
    del os.environ["STREAMLIT_THEME_SIDEBAR_DATAFRAME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8f3c71ab0018838a — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:110 
    del os.environ["STREAMLIT_THEME_DARK_SIDEBAR_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f0c03f448259b116 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_sidebar_theme_test.py:111 
    del os.environ["STREAMLIT_THEME_DARK_SIDEBAR_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4992471ce881e30d — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:53 
    os.environ["STREAMLIT_THEME_BASE"] = "dark"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3d15a90b517d38ec — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:54 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#004cbe"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c474a526cf7b23f4 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:55 
    os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"] = "#191e24"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #749a801adca76d20 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:56 
    os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"] = "#0f161e"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #905e22b41495b3f7 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:57 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "#bdc4d5"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #721a25fe50ddc616 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:58 
    os.environ["STREAMLIT_THEME_BORDER_COLOR"] = "#293246"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8fc2e43db29f2d24 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:59 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "14"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8b80fbf337cd5303 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:60 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8b52383500f591ab — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:64 
    os.environ["STREAMLIT_THEME_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #482b2225ed119472 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:68 
    os.environ["STREAMLIT_THEME_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #165d93e6c87e08a9 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:73 
    os.environ["STREAMLIT_THEME_DARK_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #58af75329b4d2887 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:76 
    os.environ["STREAMLIT_THEME_DARK_CODE_FONT_SIZE"] = "13px"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f066ff385020e1c3 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:77 
    os.environ["STREAMLIT_THEME_DARK_CODE_TEXT_COLOR"] = "#d4c6f5"  # lavender

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3d663014028529d2 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:78 
    os.environ["STREAMLIT_THEME_DARK_LINK_COLOR"] = "#CD1C18"  # chili red

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #26ad78f4a0516800 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:80 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0da4bd204e43464a — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:81 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2552b8505a68e1a6 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:82 
    del os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #442a00516b135f5d — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:83 
    del os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #248a530b73330df8 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:84 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1221a9138ad5ae2a — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:85 
    del os.environ["STREAMLIT_THEME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cf2930358cc49b73 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:86 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eeba36734f53b70d — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:87 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #47695c206f106a5b — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:88 
    del os.environ["STREAMLIT_THEME_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f16133801f943818 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:89 
    del os.environ["STREAMLIT_THEME_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9336f5b06718a9a2 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:90 
    del os.environ["STREAMLIT_THEME_DARK_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #23250a0deb80ac70 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:91 
    del os.environ["STREAMLIT_THEME_DARK_CODE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c8e0e43cd08643f7 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:92 
    del os.environ["STREAMLIT_THEME_DARK_CODE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #314cd3b1db1a4992 — Environment-variable access.
repo/e2e_playwright/theming/custom_dark_theme_test.py:93 
    del os.environ["STREAMLIT_THEME_DARK_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #754ea67563258c0c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:30 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "14"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cedc8dd842313434 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:31 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#1a6ce7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bc7cc31d75cef02c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:32 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "#1e252f"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #190abee5227ed4a6 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:35 
    os.environ["STREAMLIT_THEME_LIGHT_BACKGROUND_COLOR"] = "#ffffff"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1fe1e7955ff00c04 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:36 
    os.environ["STREAMLIT_THEME_LIGHT_SECONDARY_BACKGROUND_COLOR"] = "#f7f7f7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4bd76da89d1cc639 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:37 
    os.environ["STREAMLIT_THEME_LIGHT_BORDER_COLOR"] = "#d5dae4"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #062751459275d5d9 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:38 
    os.environ["STREAMLIT_THEME_LIGHT_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fffeada46d899e00 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:42 
    os.environ["STREAMLIT_THEME_LIGHT_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #47b6304db11a6fcc — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:46 
    os.environ["STREAMLIT_THEME_LIGHT_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #92c6136d6b4375b5 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:51 
    os.environ["STREAMLIT_THEME_SIDEBAR_BACKGROUND_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #892bc9db6613524c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:54 
    os.environ["STREAMLIT_THEME_SIDEBAR_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0cbbc64f258b629b — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:57 
    os.environ["STREAMLIT_THEME_SIDEBAR_DATAFRAME_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5304c9a4a9dbccec — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:62 
    os.environ["STREAMLIT_THEME_LIGHT_SIDEBAR_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5e867a41ecd64a24 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:65 
    os.environ["STREAMLIT_THEME_LIGHT_SIDEBAR_LINK_COLOR"] = "#7851A9"  # royal purple

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cfe5772519c13692 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:67 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2216a9a54beb4fc0 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:68 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f14bd1c92dc117cc — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:69 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d484c248a740ab7b — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:70 
    del os.environ["STREAMLIT_THEME_LIGHT_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f7feb96b7b7cb036 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:71 
    del os.environ["STREAMLIT_THEME_LIGHT_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f98cd715e0dc649e — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:72 
    del os.environ["STREAMLIT_THEME_LIGHT_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5fc88d70b79d7b43 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:73 
    del os.environ["STREAMLIT_THEME_LIGHT_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c9e9b5c10cd87f5b — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:74 
    del os.environ["STREAMLIT_THEME_LIGHT_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5e1c67c4a4350f1d — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:75 
    del os.environ["STREAMLIT_THEME_LIGHT_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #63ff9e3f8bd590b8 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:76 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e57fc5e2206a604b — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:77 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0207aff1a917a67e — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:78 
    del os.environ["STREAMLIT_THEME_SIDEBAR_DATAFRAME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4766482c655bad38 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:79 
    del os.environ["STREAMLIT_THEME_LIGHT_SIDEBAR_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #592b3ff260026291 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_sidebar_theme_test.py:80 
    del os.environ["STREAMLIT_THEME_LIGHT_SIDEBAR_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ea3a3b01b6eb67a1 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:34 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#1a6ce7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1b12561b80d76352 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:35 
    os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"] = "#ffffff"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f4a8236e68635296 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:36 
    os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"] = "#f7f7f7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #48f6ad7b95c12553 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:37 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "#1e252f"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6a1ed3609a4d71ab — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:38 
    os.environ["STREAMLIT_THEME_BORDER_COLOR"] = "#d5dae4"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f7556b55b09254c9 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:39 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "14"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #98dd8d8883413ea2 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:40 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5249409392578b02 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:44 
    os.environ["STREAMLIT_THEME_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cf07e28295447d00 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:48 
    os.environ["STREAMLIT_THEME_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f8a5a57244662507 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:53 
    os.environ["STREAMLIT_THEME_LIGHT_BORDER_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a5acd2b09ef12506 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:56 
    os.environ["STREAMLIT_THEME_LIGHT_CODE_FONT_SIZE"] = "13px"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #96640fb2c9707f0c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:57 
    os.environ["STREAMLIT_THEME_LIGHT_CODE_TEXT_COLOR"] = "#FF69B4"  # hot pink

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ff3541bca57d06c9 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:58 
    os.environ["STREAMLIT_THEME_LIGHT_LINK_COLOR"] = "#89CFF0"  # baby blue

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ef67f490e0c32a00 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:60 
    os.environ["STREAMLIT_THEME_DARK_PRIMARY_COLOR"] = "#228B22"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3940eda153491b2c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:61 
    os.environ["STREAMLIT_THEME_DARK_BORDER_COLOR"] = "#ff6700"  # hazard orange

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #324af766cfdd6b1b — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:62 
    os.environ["STREAMLIT_THEME_DARK_CODE_FONT_SIZE"] = "13px"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7d9325b727062e7a — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:63 
    os.environ["STREAMLIT_THEME_DARK_CODE_TEXT_COLOR"] = "#FF69B4"  # hot pink

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6763c5f61225791d — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:64 
    os.environ["STREAMLIT_THEME_DARK_LINK_COLOR"] = "#89CFF0"  # baby blue

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b996b6e4d0d48d3b — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:66 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ee962de1e65e7abc — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:67 
    del os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f28146524fb55c48 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:68 
    del os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8239a26cdb600ac7 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:69 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cdb21d487becae37 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:70 
    del os.environ["STREAMLIT_THEME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #614e6dd5755f7459 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:71 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9dcb85576d724e7c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:72 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ca1a87554be5dfab — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:73 
    del os.environ["STREAMLIT_THEME_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0c0ebefb5b79384c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:74 
    del os.environ["STREAMLIT_THEME_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a666046588b8aa7 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:75 
    del os.environ["STREAMLIT_THEME_LIGHT_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ca87607d69c615b6 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:76 
    del os.environ["STREAMLIT_THEME_LIGHT_CODE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #84bce948ed5e074c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:77 
    del os.environ["STREAMLIT_THEME_LIGHT_CODE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ef179de58cdf13b3 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:78 
    del os.environ["STREAMLIT_THEME_LIGHT_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8a603f36d6a91b2c — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:79 
    del os.environ["STREAMLIT_THEME_DARK_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2531e71a2f22d4b3 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:80 
    del os.environ["STREAMLIT_THEME_DARK_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #32d2378eebecd05e — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:81 
    del os.environ["STREAMLIT_THEME_DARK_CODE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4723b363ba25a5d7 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:82 
    del os.environ["STREAMLIT_THEME_DARK_CODE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e602cc502634b0b7 — Environment-variable access.
repo/e2e_playwright/theming/custom_light_theme_test.py:83 
    del os.environ["STREAMLIT_THEME_DARK_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #304116175e378a19 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:29 
    os.environ["STREAMLIT_THEME_RED_COLOR"] = "#7d353b"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2cb86b00651e756d — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:30 
    os.environ["STREAMLIT_THEME_ORANGE_COLOR"] = "#d95a00"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #966943f1d99bdc1e — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:31 
    os.environ["STREAMLIT_THEME_YELLOW_COLOR"] = "#916e10"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5672e84b8e18ac61 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:32 
    os.environ["STREAMLIT_THEME_BLUE_COLOR"] = "#004280"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #140aeac7f5cf0ba7 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:33 
    os.environ["STREAMLIT_THEME_GREEN_COLOR"] = "#177233"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d42aea3f0242bab2 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:34 
    os.environ["STREAMLIT_THEME_VIOLET_COLOR"] = "#583f84"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #06b5442a98f3968d — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:35 
    os.environ["STREAMLIT_THEME_GRAY_COLOR"] = "#0e1117"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c28d02ddbdd5ab2b — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:36 
    os.environ["STREAMLIT_THEME_SIDEBAR_RED_COLOR"] = "#ffc7c7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8d1481efbd60da3b — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:37 
    os.environ["STREAMLIT_THEME_SIDEBAR_ORANGE_COLOR"] = "#ffd16a"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #42f667b7fddfdf08 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:38 
    os.environ["STREAMLIT_THEME_SIDEBAR_YELLOW_COLOR"] = "#ffffa0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dd6d3c763872697c — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:39 
    os.environ["STREAMLIT_THEME_SIDEBAR_BLUE_COLOR"] = "#a6dcff"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9d971371e518af71 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:40 
    os.environ["STREAMLIT_THEME_SIDEBAR_GREEN_COLOR"] = "#9ef6bb"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #683ba752db25c006 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:41 
    os.environ["STREAMLIT_THEME_SIDEBAR_VIOLET_COLOR"] = "#dbbbff"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7ed48279aff741ad — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:42 
    os.environ["STREAMLIT_THEME_SIDEBAR_GRAY_COLOR"] = "#e6eaf1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9b5490a03847053d — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:47 
    del os.environ["STREAMLIT_THEME_RED_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1a1aaedbf8f969c8 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:48 
    del os.environ["STREAMLIT_THEME_ORANGE_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #aceff26d1c7fbab6 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:49 
    del os.environ["STREAMLIT_THEME_YELLOW_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d65222df6e4e7da2 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:50 
    del os.environ["STREAMLIT_THEME_BLUE_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9797832b397086ab — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:51 
    del os.environ["STREAMLIT_THEME_GREEN_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2ba719080843dc7d — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:52 
    del os.environ["STREAMLIT_THEME_VIOLET_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ddcb9e6e60c3c52d — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:53 
    del os.environ["STREAMLIT_THEME_GRAY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #87c81e4847679439 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:54 
    del os.environ["STREAMLIT_THEME_SIDEBAR_RED_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ec331af11aca0795 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:55 
    del os.environ["STREAMLIT_THEME_SIDEBAR_ORANGE_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1356774874553296 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:56 
    del os.environ["STREAMLIT_THEME_SIDEBAR_YELLOW_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #908b6d8aea3c9d99 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:57 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BLUE_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4b93b3e59c53a095 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:58 
    del os.environ["STREAMLIT_THEME_SIDEBAR_GREEN_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #49173f0817960454 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:59 
    del os.environ["STREAMLIT_THEME_SIDEBAR_VIOLET_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a0b472ffa84ae67 — Environment-variable access.
repo/e2e_playwright/theming/custom_main_colors_test.py:60 
    del os.environ["STREAMLIT_THEME_SIDEBAR_GRAY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d2ea1ea1334a5423 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:30 
    os.environ["STREAMLIT_THEME_RED_TEXT_COLOR"] = "#e74c3c"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e5adb0f3f6460bfc — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:31 
    os.environ["STREAMLIT_THEME_ORANGE_TEXT_COLOR"] = "#f39c12"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #83f62aa2fe4ba6c0 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:32 
    os.environ["STREAMLIT_THEME_YELLOW_TEXT_COLOR"] = "#f1c40f"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2c92fd88b197ebc6 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:33 
    os.environ["STREAMLIT_THEME_BLUE_TEXT_COLOR"] = "#3498db"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f72166c84431aff0 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:34 
    os.environ["STREAMLIT_THEME_GREEN_TEXT_COLOR"] = "#27ae60"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7f668fe37df246ad — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:35 
    os.environ["STREAMLIT_THEME_VIOLET_TEXT_COLOR"] = "#9b59b6"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #87e615a0ffe930d5 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:36 
    os.environ["STREAMLIT_THEME_GRAY_TEXT_COLOR"] = "#7f8c8d"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9074fdd0c9d2ec8a — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:38 
    os.environ["STREAMLIT_THEME_SIDEBAR_RED_TEXT_COLOR"] = "#8b0000"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3fbe8942d59ba998 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:39 
    os.environ["STREAMLIT_THEME_SIDEBAR_ORANGE_TEXT_COLOR"] = "#cc4400"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #02b61f1f418d8942 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:40 
    os.environ["STREAMLIT_THEME_SIDEBAR_YELLOW_TEXT_COLOR"] = "#b8860b"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3f3d2a358cc68237 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:41 
    os.environ["STREAMLIT_THEME_SIDEBAR_BLUE_TEXT_COLOR"] = "#000080"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e6b5bce01bac625a — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:42 
    os.environ["STREAMLIT_THEME_SIDEBAR_GREEN_TEXT_COLOR"] = "#006400"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1ef0ba8ba1afb498 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:43 
    os.environ["STREAMLIT_THEME_SIDEBAR_VIOLET_TEXT_COLOR"] = "#4b0082"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a31e39417495944 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:44 
    os.environ["STREAMLIT_THEME_SIDEBAR_GRAY_TEXT_COLOR"] = "#2f2f2f"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #94e007d4d1a930bf — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:46 
    del os.environ["STREAMLIT_THEME_RED_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #39ca9fdd22c81dd5 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:47 
    del os.environ["STREAMLIT_THEME_ORANGE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a8294aa1ed432851 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:48 
    del os.environ["STREAMLIT_THEME_YELLOW_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b7a25e2e6740a6f3 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:49 
    del os.environ["STREAMLIT_THEME_BLUE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d2a5924e0fd5927e — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:50 
    del os.environ["STREAMLIT_THEME_GREEN_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d750ac777e24a60d — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:51 
    del os.environ["STREAMLIT_THEME_VIOLET_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #addd315d70243e49 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:52 
    del os.environ["STREAMLIT_THEME_GRAY_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ca33b5badb965ac3 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:53 
    del os.environ["STREAMLIT_THEME_SIDEBAR_RED_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #31e5f1bff884b152 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:54 
    del os.environ["STREAMLIT_THEME_SIDEBAR_ORANGE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a28e341ae34a9adc — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:55 
    del os.environ["STREAMLIT_THEME_SIDEBAR_YELLOW_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #63e45d72fac246a9 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:56 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BLUE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8fce426d3721feac — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:57 
    del os.environ["STREAMLIT_THEME_SIDEBAR_GREEN_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #880a37f87ad66449 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:58 
    del os.environ["STREAMLIT_THEME_SIDEBAR_VIOLET_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #65a3cee26ada4681 — Environment-variable access.
repo/e2e_playwright/theming/custom_text_colors_test.py:59 
    del os.environ["STREAMLIT_THEME_SIDEBAR_GRAY_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6d1663f3228213d8 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:29 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #72ad43cd7eb77eab — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:33 
    os.environ["STREAMLIT_THEME_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0c8b9e375fa35d93 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:37 
    os.environ["STREAMLIT_THEME_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1b2fc061f9d0eea4 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:41 
    os.environ["STREAMLIT_THEME_SIDEBAR_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f79d50f3833934af — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:44 
    os.environ["STREAMLIT_THEME_SIDEBAR_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #053f570171ec59a4 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:47 
    os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c91c403e92902b0d — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:51 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #541364f63a561ca7 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:52 
    del os.environ["STREAMLIT_THEME_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ee34b952eaf503bc — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:53 
    del os.environ["STREAMLIT_THEME_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7e8cd783c7417a99 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:54 
    del os.environ["STREAMLIT_THEME_SIDEBAR_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #edaed7938d8c31de — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:55 
    del os.environ["STREAMLIT_THEME_SIDEBAR_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3edb35f9515b8076 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_fonts_test.py:56 
    del os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dbd653c14f81bcef — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:29 
    os.environ["STREAMLIT_THEME_BASE"] = "dark"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ad4d3d32f7a67611 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:30 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#1BD760"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #da27b144044a43cb — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:31 
    os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"] = "#001200"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #abddbfb25730ac80 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:32 
    os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"] = "#03200C"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b08eae41c94894c5 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:33 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "#DFFDE0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #06a666cbc5852b29 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:34 
    os.environ["STREAMLIT_THEME_BASE_RADIUS"] = "1.2rem"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #71026a1c9bad5c35 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:35 
    os.environ["STREAMLIT_THEME_BUTTON_RADIUS"] = "0.57rem"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9c74267a6699d3d0 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:36 
    os.environ["STREAMLIT_THEME_BORDER_COLOR"] = "#0B4C0B"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ac0c1453874e131b — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:37 
    os.environ["STREAMLIT_THEME_DATAFRAME_BORDER_COLOR"] = "#f0ee86"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eae2f5968762c4d7 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:38 
    os.environ["STREAMLIT_THEME_DATAFRAME_HEADER_BACKGROUND_COLOR"] = "#70aec1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #266184fec5d54c39 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:39 
    os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e4de87ca9331624a — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:40 
    os.environ["STREAMLIT_THEME_LINK_COLOR"] = "#2EC163"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2342b956db10ab81 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:41 
    os.environ["STREAMLIT_THEME_CODE_FONT_SIZE"] = "15px"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2eb3b2ee784c052e — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:42 
    os.environ["STREAMLIT_THEME_CODE_TEXT_COLOR"] = "#301934"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a89f19c478ffc7f9 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:43 
    os.environ["STREAMLIT_THEME_CODE_BACKGROUND_COLOR"] = "#d4c6f5"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a04ab810f63a64f5 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:44 
    os.environ["STREAMLIT_THEME_SHOW_SIDEBAR_BORDER"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1f4e34b9f8d39b09 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:45 
    os.environ["STREAMLIT_THEME_HEADING_FONT"] = "bold, serif"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c66b14fd500cfde0 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:46 
    os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"] = "minimal"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6866beee309bc3a2 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:48 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c2d13715fae97508 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:49 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3cfbf0560eb850c6 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:50 
    del os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bbec3662d79f78fd — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:51 
    del os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #605c9c6364e36638 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:52 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e7a8886388aac998 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:53 
    del os.environ["STREAMLIT_THEME_BASE_RADIUS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3f1acfeedf455f6e — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:54 
    del os.environ["STREAMLIT_THEME_BUTTON_RADIUS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e8396d39694051c6 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:55 
    del os.environ["STREAMLIT_THEME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9ac5521d28b2a3f3 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:56 
    del os.environ["STREAMLIT_THEME_DATAFRAME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dc090bb39450edc5 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:57 
    del os.environ["STREAMLIT_THEME_DATAFRAME_HEADER_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9d060002d1acfe81 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:58 
    del os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #853adc48b3f52a87 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:59 
    del os.environ["STREAMLIT_THEME_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #610cdfad93759b5d — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:60 
    del os.environ["STREAMLIT_THEME_CODE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #851fcb5a2394d62e — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:61 
    del os.environ["STREAMLIT_THEME_CODE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #34fca892b1e87757 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:62 
    del os.environ["STREAMLIT_THEME_CODE_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0fa756f093eef501 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:63 
    del os.environ["STREAMLIT_THEME_SHOW_SIDEBAR_BORDER"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #53563eb83ff2c931 — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:64 
    del os.environ["STREAMLIT_THEME_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7a725578ad07fcca — Environment-variable access.
repo/e2e_playwright/theming/custom_theme_test.py:65 
    del os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fd7e7400488ee46a — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:41 
    os.environ["STREAMLIT_THEME_BASE"] = "https://data.streamlit.io/corporate.toml"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6aea3ac56d599672 — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:42 
    os.environ["STREAMLIT_THEME_LINK_COLOR"] = "#CD1C18"  # Chili red

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ae8c226a37f9cc9f — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:43 
    os.environ["STREAMLIT_THEME_CODE_BACKGROUND_COLOR"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d23cee2268b34e6f — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:46 
    os.environ["STREAMLIT_THEME_SIDEBAR_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cbb68835f2aa4e52 — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:49 
    os.environ["STREAMLIT_THEME_SIDEBAR_LINK_COLOR"] = "#7851A9"  # Royal purple

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bce8107d40b2e8e8 — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:52 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #321e7c2a3e135f75 — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:53 
    del os.environ["STREAMLIT_THEME_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #825b8b82ac050852 — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:54 
    del os.environ["STREAMLIT_THEME_CODE_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ebdf0b1f36fc4cbe — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:55 
    del os.environ["STREAMLIT_THEME_SIDEBAR_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2a08e459358afeed — Environment-variable access.
repo/e2e_playwright/theming/custom_url_base_test.py:56 
    del os.environ["STREAMLIT_THEME_SIDEBAR_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6c4e64b0dcd9ac90 — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:30 
    os.environ["STREAMLIT_THEME_FONT_FACES"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #785739d4b9997f5e — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:46 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #52c7ce9b7bcd5a27 — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:49 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "16"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cfc8dff056d56907 — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:50 
    os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"] = "minimal"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8d64bc04c1d12c96 — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:52 
    del os.environ["STREAMLIT_THEME_FONT_FACES"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a2c52c0eeb67726a — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:53 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e4d1bc32b45c7203 — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:54 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1383ab358ff6d411 — Environment-variable access.
repo/e2e_playwright/theming/font_style_test.py:55 
    del os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a4072aed537e8031 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:30 
    os.environ["STREAMLIT_THEME_FONT_FACES"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2067496ce4f67ed5 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:66 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a2c0e14f28f15062 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:69 
    os.environ["STREAMLIT_THEME_SIDEBAR_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ea17a81482dd5f45 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:72 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "16"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #19601ffa918d4ba3 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:73 
    os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"] = "minimal"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #73d12389cdec192b — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:75 
    del os.environ["STREAMLIT_THEME_FONT_FACES"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2165e52c6a568154 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:76 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #635223433fe3e19b — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:77 
    del os.environ["STREAMLIT_THEME_SIDEBAR_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5693f45c05d333c4 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:78 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fd05215da38e6719 — Environment-variable access.
repo/e2e_playwright/theming/font_unicode_range_test.py:79 
    del os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1c4354527ad6d12a — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:30 
    os.environ["STREAMLIT_THEME_FONT_FACES"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4c6ebbf43d5f2939 — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:70 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d570108262f9d5e2 — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:73 
    os.environ["STREAMLIT_THEME_SIDEBAR_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e62549a079d0356b — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:76 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "16"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cbe8ae6950109ca9 — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:77 
    os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"] = "minimal"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f8e6046af0fc7e61 — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:79 
    del os.environ["STREAMLIT_THEME_FONT_FACES"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #04b67048827fc923 — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:80 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d77d799018df139c — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:81 
    del os.environ["STREAMLIT_THEME_SIDEBAR_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9accc5b432c5549c — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:82 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0f7bece1487dc70e — Environment-variable access.
repo/e2e_playwright/theming/font_weight_test.py:83 
    del os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d58774354bd3c479 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:29 
    os.environ["STREAMLIT_THEME_BASE"] = "light"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d6082d6b50756243 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:30 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "14"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #da3a9a4461ddd2bf — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:31 
    os.environ["STREAMLIT_THEME_BASE_RADIUS"] = "full"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fe24bb1ef14e852c — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:32 
    os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1e392517e4f1cc8b — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:33 
    os.environ["STREAMLIT_THEME_SIDEBAR_BACKGROUND_COLOR"] = "black"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3354c33b2dd6ffaf — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:34 
    os.environ["STREAMLIT_THEME_SIDEBAR_BASE_RADIUS"] = "none"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0f90ffd5110abf48 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:35 
    os.environ["STREAMLIT_THEME_SIDEBAR_BUTTON_RADIUS"] = "small"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2b4ca1883cfadf6d — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:36 
    os.environ["STREAMLIT_THEME_SIDEBAR_BORDER_COLOR"] = "white"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #90b46bc10a140e66 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:37 
    os.environ["STREAMLIT_THEME_SIDEBAR_DATAFRAME_BORDER_COLOR"] = "orange"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3308bbea86d8c962 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:38 
    os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT"] = "bold, serif"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d06e1fe901451ff4 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:39 
    os.environ["STREAMLIT_THEME_SIDEBAR_CODE_FONT_SIZE"] = "0.625rem"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #19bdcb3a227b0eef — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:40 
    os.environ["STREAMLIT_THEME_SIDEBAR_LINK_COLOR"] = "#90EE90"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e6eb337797118cbc — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:41 
    os.environ["STREAMLIT_THEME_SIDEBAR_CODE_TEXT_COLOR"] = "#601EF9"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e28839a5354559e0 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:42 
    os.environ["STREAMLIT_THEME_SIDEBAR_CODE_BACKGROUND_COLOR"] = "#d4c6f5"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b60985b0e5e73b49 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:43 
    os.environ["STREAMLIT_THEME_SIDEBAR_PRIMARY_COLOR"] = "blue"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3e5effbcd856e270 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:44 
    os.environ["STREAMLIT_THEME_SIDEBAR_SECONDARY_BACKGROUND_COLOR"] = "#222222"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dfa61508d60f8c7d — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:45 
    os.environ["STREAMLIT_THEME_SIDEBAR_TEXT_COLOR"] = "white"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #04c4d0369e561172 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:46 
    os.environ["STREAMLIT_THEME_SIDEBAR_LINK_UNDERLINE"] = "False"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eff8cbb751d5b6cd — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:47 
    os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"] = "minimal"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #31e188b54145af6b — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:49 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7b2c352eedfa49c6 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:50 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4ff8bf71cd2734f5 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:51 
    del os.environ["STREAMLIT_THEME_BASE_RADIUS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a029ef18c67a8b6f — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:52 
    del os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #73ba95054119aa41 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:53 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #867b998a9a6164d5 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:54 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BASE_RADIUS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #55860f550a528051 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:55 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BUTTON_RADIUS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0cd00ddd8a72f367 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:56 
    del os.environ["STREAMLIT_THEME_SIDEBAR_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6e6966ef2e04bbc8 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:57 
    del os.environ["STREAMLIT_THEME_SIDEBAR_DATAFRAME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #aac2c6ac614a4567 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:58 
    del os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ffac1a80b17dc566 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:59 
    del os.environ["STREAMLIT_THEME_SIDEBAR_CODE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b43d7f709111cfe6 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:60 
    del os.environ["STREAMLIT_THEME_SIDEBAR_LINK_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ce48da6f30678701 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:61 
    del os.environ["STREAMLIT_THEME_SIDEBAR_CODE_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c1b45e8b056b7cc1 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:62 
    del os.environ["STREAMLIT_THEME_SIDEBAR_CODE_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9df1a09c5641b61b — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:63 
    del os.environ["STREAMLIT_THEME_SIDEBAR_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c5894cd49f283afb — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:64 
    del os.environ["STREAMLIT_THEME_SIDEBAR_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #84d429f93dc8605e — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:65 
    del os.environ["STREAMLIT_THEME_SIDEBAR_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b9005c199ee6b214 — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:66 
    del os.environ["STREAMLIT_THEME_SIDEBAR_LINK_UNDERLINE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4a8f4973ee20ef9e — Environment-variable access.
repo/e2e_playwright/theming/sidebar_custom_theme_test.py:67 
    del os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a194ae2242e8411 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:30 
    os.environ["STREAMLIT_THEME_BASE"] = "dark"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #656b8e09374888da — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:31 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#004cbe"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8b80591d09ab262a — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:32 
    os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"] = "#191e24"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eb0bf8650a543760 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:33 
    os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"] = "#0f161e"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0e3c15cb2c5c568d — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:34 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "oklab(79.31% -0.019 -0.063)"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #07ddd53b388748fb — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:35 
    os.environ["STREAMLIT_THEME_BORDER_COLOR"] = "#293246"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d31a4a6755614cbf — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:36 
    os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a4e3763454e8005 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:37 
    os.environ["STREAMLIT_THEME_FONT_FACES"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e0cfb6b8c79b7e4f — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:76 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3ad98ba64a5386c1 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:80 
    os.environ["STREAMLIT_THEME_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4d52f671c3536fa2 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:84 
    os.environ["STREAMLIT_THEME_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b9aef1051c29c75f — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:87 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "14"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8a42900f15583675 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:88 
    os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"] = "minimal"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #58559fa0e2a78e9a — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:90 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #da49c11df761abaf — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:91 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #709146b749a93e78 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:92 
    del os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e313b0d2d145644b — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:93 
    del os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f74aabe9c0b69daf — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:94 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0897a3a4f04be92a — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:95 
    del os.environ["STREAMLIT_THEME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dd70f9ac0f90d242 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:96 
    del os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9dba877591deb96b — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:97 
    del os.environ["STREAMLIT_THEME_FONT_FACES"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #08db93d783cc288c — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:98 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1f10fa2e1c147ed7 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:99 
    del os.environ["STREAMLIT_THEME_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0e1948207971c526 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:100 
    del os.environ["STREAMLIT_THEME_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6fa25c91253b4488 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:101 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e5c26f9109781f92 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_dark_theme_test.py:102 
    del os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b526d32bffae2fe9 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:30 
    os.environ["STREAMLIT_THEME_BASE"] = "light"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3679c38f2bd217b5 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:31 
    os.environ["STREAMLIT_THEME_PRIMARY_COLOR"] = "#1a6ce7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b002d7cd9aa9a858 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:32 
    os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"] = "#ffffff"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2cfa97ece1e37f12 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:33 
    os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"] = "#f7f7f7"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9c6783880019302b — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:34 
    os.environ["STREAMLIT_THEME_TEXT_COLOR"] = "oklch(20.36% 0.024 253)"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3542579e13d98e72 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:35 
    os.environ["STREAMLIT_THEME_BORDER_COLOR"] = "#d5dae4"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #11e74ea920cb6ec1 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:36 
    os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #376423c6aa5e513f — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:37 
    os.environ["STREAMLIT_THEME_FONT_FACES"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7c31dde8095c8cfc — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:76 
    os.environ["STREAMLIT_THEME_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #662c72b7d58b9ada — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:80 
    os.environ["STREAMLIT_THEME_HEADING_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #730f9387107ce3b3 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:84 
    os.environ["STREAMLIT_THEME_CODE_FONT"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b2f3e656c7489a5a — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:87 
    os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"] = "14"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0f6707bfb06d5e5a — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:88 
    os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"] = "minimal"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6dd298034dc774c5 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:90 
    del os.environ["STREAMLIT_THEME_BASE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d5a0c30a5ceaaaa2 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:91 
    del os.environ["STREAMLIT_THEME_PRIMARY_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #40eeba6cec131eba — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:92 
    del os.environ["STREAMLIT_THEME_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cf0284dc375de439 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:93 
    del os.environ["STREAMLIT_THEME_SECONDARY_BACKGROUND_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #058145043aff83ce — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:94 
    del os.environ["STREAMLIT_THEME_TEXT_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e3c025fca5ac1d4a — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:95 
    del os.environ["STREAMLIT_THEME_BORDER_COLOR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bec42a6fb4cacd19 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:96 
    del os.environ["STREAMLIT_THEME_SHOW_WIDGET_BORDER"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #14a896c15de2423d — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:97 
    del os.environ["STREAMLIT_THEME_FONT_FACES"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ba134568d8dda10a — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:98 
    del os.environ["STREAMLIT_THEME_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e53a2debb9863d25 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:99 
    del os.environ["STREAMLIT_THEME_HEADING_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bc6e9aa9fd6d52a1 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:100 
    del os.environ["STREAMLIT_THEME_CODE_FONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a318180bd3c120ac — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:101 
    del os.environ["STREAMLIT_THEME_BASE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #58d9975951143ba0 — Environment-variable access.
repo/e2e_playwright/theming/snowflake_light_theme_test.py:102 
    del os.environ["STREAMLIT_CLIENT_TOOLBAR_MODE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2a2fc492a7449c49 — Environment-variable access.
repo/e2e_playwright/theming/theme_chart_colors_test.py:33 
    os.environ["STREAMLIT_THEME_CHART_CATEGORICAL_COLORS"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f23d92babc41a840 — Environment-variable access.
repo/e2e_playwright/theming/theme_chart_colors_test.py:47 
    os.environ["STREAMLIT_THEME_CHART_SEQUENTIAL_COLORS"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #551efd2dc4a34f2b — Environment-variable access.
repo/e2e_playwright/theming/theme_chart_colors_test.py:61 
    os.environ["STREAMLIT_THEME_CHART_DIVERGING_COLORS"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6797fc378f6b327d — Environment-variable access.
repo/e2e_playwright/theming/theme_chart_colors_test.py:76 
    del os.environ["STREAMLIT_THEME_CHART_CATEGORICAL_COLORS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4311fb3dda5fdc40 — Environment-variable access.
repo/e2e_playwright/theming/theme_chart_colors_test.py:77 
    del os.environ["STREAMLIT_THEME_CHART_SEQUENTIAL_COLORS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c20684f20fe9eb5c — Environment-variable access.
repo/e2e_playwright/theming/theme_chart_colors_test.py:78 
    del os.environ["STREAMLIT_THEME_CHART_DIVERGING_COLORS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b25baf1180977cf8 — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:29 
    os.environ["STREAMLIT_THEME_BASE_FONT_WEIGHT"] = "200"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2b7b473f342c45d8 — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:30 
    os.environ["STREAMLIT_THEME_CODE_FONT_WEIGHT"] = "600"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a6743731c99655f6 — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:31 
    os.environ["STREAMLIT_THEME_HEADING_FONT_WEIGHTS"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c62df49366504362 — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:35 
    os.environ["STREAMLIT_THEME_SIDEBAR_CODE_FONT_WEIGHT"] = "200"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ae8bab8bef7c4d6d — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:36 
    os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT_WEIGHTS"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #68d04c219299da3b — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:40 
    del os.environ["STREAMLIT_THEME_BASE_FONT_WEIGHT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #72677c8c50fe83b9 — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:41 
    del os.environ["STREAMLIT_THEME_CODE_FONT_WEIGHT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #40d0c945248cfebf — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:42 
    del os.environ["STREAMLIT_THEME_HEADING_FONT_WEIGHTS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6167a1f4ffb03669 — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:43 
    del os.environ["STREAMLIT_THEME_SIDEBAR_CODE_FONT_WEIGHT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fbac7aafa47cea47 — Environment-variable access.
repo/e2e_playwright/theming/theme_font_weights_test.py:44 
    del os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT_WEIGHTS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0cce82671ee9d48e — Environment-variable access.
repo/e2e_playwright/theming/theme_header_sizes_test.py:29 
    os.environ["STREAMLIT_THEME_HEADING_FONT_SIZES"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6d946071628e111e — Environment-variable access.
repo/e2e_playwright/theming/theme_header_sizes_test.py:33 
    os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT_SIZES"] = json.dumps(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #72caecd5a88bbd8a — Environment-variable access.
repo/e2e_playwright/theming/theme_header_sizes_test.py:37 
    del os.environ["STREAMLIT_THEME_HEADING_FONT_SIZES"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #35fce6528217b8ec — Environment-variable access.
repo/e2e_playwright/theming/theme_header_sizes_test.py:38 
    del os.environ["STREAMLIT_THEME_SIDEBAR_HEADING_FONT_SIZES"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #950619931d510e7c — Environment-variable access.
repo/e2e_playwright/theming/theme_metric_value_style_test.py:30 
    os.environ["STREAMLIT_THEME_METRIC_VALUE_FONT_SIZE"] = "3rem"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c118efa005c9346e — Environment-variable access.
repo/e2e_playwright/theming/theme_metric_value_style_test.py:31 
    os.environ["STREAMLIT_THEME_METRIC_VALUE_FONT_WEIGHT"] = "300"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7acb4f585ae217be — Environment-variable access.
repo/e2e_playwright/theming/theme_metric_value_style_test.py:33 
    del os.environ["STREAMLIT_THEME_METRIC_VALUE_FONT_SIZE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #74179ada03500b78 — Environment-variable access.
repo/e2e_playwright/theming/theme_metric_value_style_test.py:34 
    del os.environ["STREAMLIT_THEME_METRIC_VALUE_FONT_WEIGHT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8ee44ab2425b642c — Filesystem access.
repo/scripts/changelog_categorize_prs.py:195 
    with open(args.input, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7b9037a4fd77e8b7 — Filesystem access.
repo/scripts/changelog_categorize_prs.py:202 
    with open(args.output, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f9a2122907cb3eed — Filesystem access.
repo/scripts/changelog_fetch_prs.py:230 
    with open(args.output, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bcfc6415ed458d04 — Filesystem access.
repo/scripts/check_license_headers.py:33 
    (SCRIPT_DIR / "assets" / "license-template.txt").read_text().splitlines()[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8c3cc40e218bcd46 — Filesystem access.
repo/scripts/check_license_headers.py:102 
            file_content = filepath.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #69337f66fca24354 — Environment-variable access.
repo/scripts/cli_regression_tests.py:69 
        STREAMLIT_RELEASE_VERSION = os.environ.get("STREAMLIT_RELEASE_VERSION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5e61da4ffae83013 — Environment-variable access.
repo/scripts/cli_regression_tests.py:159 
        os.environ.get("SKIP_VERSION_CHECK", "false").lower() == "true",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #76bd5f3083cfffb8 — Filesystem access.
repo/scripts/cli_regression_tests.py:179 
        with open(CREDENTIALS_FILE_PATH, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f9f51ec75ba840f7 — Filesystem access.
repo/scripts/cli_regression_tests.py:216 
        with open(CONFIG_FILE_PATH, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4505b2a72aa3c97d — Environment-variable access.
repo/scripts/create_release.py:28 
    tag = os.getenv("GIT_TAG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c84edb1e9bdfe910 — Environment-variable access.
repo/scripts/create_release.py:29 
    access_token = os.getenv("GH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #bbfe54a44a07c3be — Hardcoded external endpoint. Review what data is sent to this destination.
repo/scripts/create_release.py:38 
    response = requests.get(f"{url}/latest", headers=header)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low pii_flow test-only Excluded from app score #cec97a1f129cae63 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration. Non-production path — not application runtime.
repo/scripts/create_release.py:38 · flow /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:29 → /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:38 
    response = requests.get(f"{url}/latest", headers=header)

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
low egress test-only Excluded from app score #77049fa2de94547b — Hardcoded external endpoint. Review what data is sent to this destination.
repo/scripts/create_release.py:47 
    response = requests.post(f"{url}/generate-notes", json=payload, headers=header)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low pii_flow test-only Excluded from app score #2815cec846f38dbe — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent. Non-production path — not application runtime.
repo/scripts/create_release.py:47 · flow /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:29 → /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:47 
    response = requests.post(f"{url}/generate-notes", json=payload, headers=header)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low pii_flow test-only Excluded from app score #fad36be8822b8031 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration. Non-production path — not application runtime.
repo/scripts/create_release.py:47 · flow /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:29 → /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:47 
    response = requests.post(f"{url}/generate-notes", json=payload, headers=header)

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
low egress test-only Excluded from app score #35a34bccd9be94c0 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/scripts/create_release.py:56 
    response = requests.post(url, json=payload, headers=header)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low pii_flow test-only Excluded from app score #9752981e2e00b760 — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent. Non-production path — not application runtime.
repo/scripts/create_release.py:56 · flow /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:29 → /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:56 
    response = requests.post(url, json=payload, headers=header)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low pii_flow test-only Excluded from app score #672521b51ca0a5df — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration. Non-production path — not application runtime.
repo/scripts/create_release.py:56 · flow /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:29 → /tmp/closeopen-gqtzl0z0/repo/scripts/create_release.py:56 
    response = requests.post(url, json=payload, headers=header)

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
low env_fs test-only Excluded from app score #9336d85d45a7f673 — Filesystem access.
repo/scripts/fetch_flaky_tests.py:104 
    with open(stats_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c69b100858bcc389 — Filesystem access.
repo/scripts/generate_agent_rules.py:205 
    with open(source_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7ed51aa570eb4f19 — Filesystem access.
repo/scripts/generate_agent_rules.py:219 
        with open(target_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ba3fd1bc35fb9b91 — Filesystem access.
repo/scripts/generate_agent_rules.py:233 
        with open(target_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #90f3134f8daafef9 — Filesystem access.
repo/scripts/generate_agent_rules.py:260 
    with open(skill_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5317f8dd66fe7d78 — Filesystem access.
repo/scripts/generate_agent_rules.py:289 
        with open(agents_md_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #937d6fe66c9d8cb7 — Filesystem access.
repo/scripts/generate_agent_rules.py:308 
        with open(cursor_mdc_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6326f6be975ef353 — Filesystem access.
repo/scripts/generate_agent_rules.py:326 
        with open(github_copilot_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #145e5303a9d4f742 — Filesystem access.
repo/scripts/generate_agent_rules.py:356 
        with open(claude_md_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #6cd5fa17975c6336 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/scripts/get_release_branch.py:38 
    response = requests.get(url).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #89efd28bd7ebc172 — Environment-variable access.
repo/scripts/log_agent_metrics.py:213 
    project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #2f7e7d7508cf5f76 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/scripts/pypi_nightly_create_tag.py:48 
    rsp = requests.get(PYPI_STREAMLIT_URL)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #bd3a74dbf9d3a5d8 — Environment-variable access.
repo/scripts/run_bare_execution_tests.py:55 
os.environ["MPLBACKEND"] = "Agg"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cca7bd695c4c38ca — Environment-variable access.
repo/scripts/slack_notifications.py:64 
    webhook = os.getenv("SLACK_WEBHOOK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #755b8bcca3f7a029 — Environment-variable access.
repo/scripts/slack_notifications.py:78 
    run_id = os.getenv("RUN_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #516b04c33fdb87d2 — Environment-variable access.
repo/scripts/slack_notifications.py:110 
            pr_url = os.getenv("PR_URL", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #874d5fd919c84a21 — Environment-variable access.
repo/scripts/slack_notifications.py:124 
            pr_url = os.getenv("PR_URL", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bf493dcc6d6081f8 — Environment-variable access.
repo/scripts/slack_notifications.py:137 
        repo = os.getenv("REPO", os.getenv("GITHUB_REPOSITORY", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f0e396ec2301d071 — Environment-variable access.
repo/scripts/slack_notifications.py:138 
        release_version = os.getenv("RELEASE_VERSION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b4990af47cc01ab5 — Environment-variable access.
repo/scripts/slack_notifications.py:139 
        release_branch = os.getenv("RELEASE_BRANCH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #40a8e4dea07a862e — Environment-variable access.
repo/scripts/slack_notifications.py:140 
        commit_sha = os.getenv("CHERRY_PICK_SHA", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #913c085b56ecf2cd — Environment-variable access.
repo/scripts/slack_notifications.py:143 
            base_ref = os.getenv("RELEASE_BASE_REF", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c6463dca452c07a9 — Environment-variable access.
repo/scripts/slack_notifications.py:163 
            pr_url = os.getenv("PR_URL", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6d98e3d09e6f0baa — Environment-variable access.
repo/scripts/slack_notifications.py:196 
            error_reason = os.getenv("ERROR_REASON", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1334688591859631 — Environment-variable access.
repo/scripts/slack_notifications.py:209 
        repo = os.getenv("REPO", os.getenv("GITHUB_REPOSITORY", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #23f311f7d9f3b90c — Environment-variable access.
repo/scripts/slack_notifications.py:210 
        run_id = os.getenv("RUN_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9bb8e6401b53472b — Environment-variable access.
repo/scripts/slack_notifications.py:211 
        package_name = os.getenv("PACKAGE_NAME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8fab9a1eecc6630e — Environment-variable access.
repo/scripts/slack_notifications.py:212 
        package_version = os.getenv("PACKAGE_VERSION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #64d14ecd00a0fd3d — Environment-variable access.
repo/scripts/slack_notifications.py:235 
            error_reason = os.getenv("ERROR_REASON", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #753907e0694d91b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/scripts/slack_notifications.py:252 
        response = requests.post(webhook, json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #d912fad1cdd2cbc5 — Filesystem access.
repo/scripts/snapshot_cleanup.py:168 
            with open(test_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e06d92e6de57e701 — Filesystem access.
repo/scripts/sync_ruff_version.py:49 
        with open(pyproject_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d1551402bdb6588d — Filesystem access.
repo/scripts/sync_ruff_version.py:65 
        with open(pre_commit_config_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3b379f4cb08d18f8 — Filesystem access.
repo/scripts/sync_ruff_version.py:84 
        with open(pre_commit_config_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cfc8693105ac7153 — Filesystem access.
repo/scripts/sync_ruff_version.py:95 
        with open(pre_commit_config_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ad04424abda38792 — Filesystem access.
repo/scripts/sync_vscode_devcontainer.py:84 
            with open(file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #74dab049c64e6c86 — Filesystem access.
repo/scripts/sync_vscode_devcontainer.py:109 
            with open(file_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #f11f9f060bb9723f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/scripts/update_e2e_snapshots.py:83 
    response = requests.get(url, headers=headers, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #e1c19ed615296e97 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/scripts/update_e2e_snapshots.py:134 
    response = requests.get(url, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #7b03554981b0977c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/scripts/update_e2e_snapshots.py:149 
    response = requests.get(artifact_url, headers=headers, stream=True)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #11cdf8dc9f97a13c — Filesystem access.
repo/scripts/update_e2e_snapshots.py:155 
    with open(download_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2a759d4b562016b4 — Filesystem access.
repo/scripts/update_emojis.py:49 
with open(EMOJIS_SCRIPT_PATH, encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ed599775fe686afc — Filesystem access.
repo/scripts/update_emojis.py:54 
with open(EMOJIS_SCRIPT_PATH, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #36f5308d85823f03 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/scripts/update_material_icon_font_and_names.py:65 
with urllib.request.urlopen(MATERIAL_ICONS_CODEPOINTS_URL) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #5fb830c70b2d032c — Filesystem access.
repo/scripts/update_material_icon_font_and_names.py:94 
with open(NAMES_MODULE_PATH, encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0a9594e6a481178e — Filesystem access.
repo/scripts/update_material_icon_font_and_names.py:99 
with open(NAMES_MODULE_PATH, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #c5153d428e7c8816 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/scripts/update_material_icon_font_and_names.py:104 
response = requests.get(
    MATERIAL_ICONS_FONT_URL,
    headers={
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
        "(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
    },
)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #8387864c60d0d97e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/scripts/update_material_icon_font_and_names.py:127 
    font_file = requests.get(font_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #e862225672e0b9a1 — Filesystem access.
repo/scripts/update_material_icon_font_and_names.py:128 
    with open(FONT_FILE_PATH, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9866742b64ff9e0c — Filesystem access.
repo/scripts/update_material_icon_font_and_names.py:145 
with open(PLAYWRIGHT_TEST_MODULE_PATH, encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #412e4c11c1ed74e7 — Filesystem access.
repo/scripts/update_material_icon_font_and_names.py:149 
with open(PLAYWRIGHT_TEST_MODULE_PATH, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ce64458bcd91a3b4 — Filesystem access.
repo/scripts/update_name.py:51 
    with open(file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7ef5fed05199c2ea — Filesystem access.
repo/scripts/update_name.py:81 
    with open(file_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2f0711682322e9f6 — Filesystem access.
repo/scripts/verify_version.py:45 
    with open(pyproject_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #73d0650a3ebc3ece — Environment-variable access.
repo/scripts/verify_version.py:64 
    tag = args.tag or os.getenv("TAG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (python): lib

python first-party
expand_more 56 low-confidence finding(s)
low env_fs test-only Excluded from app score #12f682e175ec6312 — Environment-variable access.
repo/lib/streamlit/.agents/meta-skill/developing-with-streamlit/scripts/discover.py:87 
    venv = os.environ.get("VIRTUAL_ENV")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a4739d1f02948028 — Environment-variable access.
repo/lib/streamlit/.agents/meta-skill/developing-with-streamlit/scripts/discover.py:110 
    conda = os.environ.get("CONDA_PREFIX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #763e8a1248f7baa2 — Environment-variable access.
repo/lib/streamlit/__init__.py:57 
_os.environ["MPLBACKEND"] = "Agg"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca9bba87bd581ceb — Filesystem access.
repo/lib/streamlit/cli_util.py:62 
    with open(os.devnull, "w", encoding="utf-8") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e78428789d05f6cf — Filesystem access.
repo/lib/streamlit/components/v2/manifest_scanner.py:266 
            pyproject_content = dist.read_text("pyproject.toml")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1870bac4904dec71 — Filesystem access.
repo/lib/streamlit/components/v2/manifest_scanner.py:364 
        with open(pyproject_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a75e2ba1b4861e1 — Filesystem access.
repo/lib/streamlit/components/v2/manifest_scanner.py:412 
        with open(pyproject_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d0da4f1048d67c66 — Environment-variable access.
repo/lib/streamlit/config.py:902 
        and not os.getenv("DISPLAY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bef65056e4e7f623 — Environment-variable access.
repo/lib/streamlit/config.py:903 
        and not os.getenv("WAYLAND_DISPLAY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cfe25b7ccd44e086 — Environment-variable access.
repo/lib/streamlit/config.py:2667 
        env_var_value = os.environ.get(opt_val.env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40125431247b608b — Environment-variable access.
repo/lib/streamlit/config.py:2811 
        env_var = os.environ.get(var_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #04808ac7c2f83297 — Filesystem access.
repo/lib/streamlit/config.py:2924 
            with open(filename, encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #a8f30e2fff262a78 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/lib/streamlit/config_util.py:633 
            with urllib.request.urlopen(file_path_or_url, timeout=30) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #85797d1abf8d9e5d — Filesystem access.
repo/lib/streamlit/config_util.py:644 
            with open(file_path_or_url, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e64b3aa64753ab05 — Filesystem access.
repo/lib/streamlit/connections/snowflake_connection.py:714 
        with open(SNOWPARK_CONNECTION_TOKEN_FILE, encoding="utf-8") as token_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4565bb4c6c0d8252 — Environment-variable access.
repo/lib/streamlit/connections/snowflake_connection.py:747 
            value = os.getenv(env_var_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3397d7828a7ecce1 — Filesystem access.
repo/lib/streamlit/elements/html.py:120 
            with open(file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7067605d99eeeba — Filesystem access.
repo/lib/streamlit/elements/iframe.py:436 
                with open(file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6b1e8de447cdf39d — Filesystem access.
repo/lib/streamlit/elements/iframe.py:450 
            with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a41000645f34985 — Filesystem access.
repo/lib/streamlit/elements/lib/image_utils.py:273 
            with open(image, encoding="utf-8") as textfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6ce9e85daed6c33 — Filesystem access.
repo/lib/streamlit/elements/lib/image_utils.py:294 
            with open(image, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07b8a59acca64d01 — Filesystem access.
repo/lib/streamlit/elements/lib/subtitle_utils.py:121 
        with open(data_or_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a7ab84b6c0c8ca90 — Filesystem access.
repo/lib/streamlit/elements/pdf.py:138 
                    with open(data_str, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5c9421fc522da919 — Environment-variable access.
repo/lib/streamlit/env_util.py:33 
    if "WSL_DISTRO_NAME" in os.environ or "WSL_INTEROP" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45e1a800597e825a — Filesystem access.
repo/lib/streamlit/env_util.py:37 
        with open("/proc/version", encoding="utf-8") as proc_version:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #49482bac8ba728b0 — Filesystem access.
repo/lib/streamlit/file_util.py:89 
    with open(os.path.join(CONFIG_FOLDER_NAME, path), mode) as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #14a73107ff92f0a5 — Filesystem access.
repo/lib/streamlit/file_util.py:115 
        with open(path, mode) as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3d549f5f042f3134 — Environment-variable access.
repo/lib/streamlit/file_util.py:223 
    pythonpath = os.environ.get("PYTHONPATH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #bd0acb9235bfb86a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/lib/streamlit/net_util.py:102 
        text = requests.get(url, timeout=timeout).text

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #d6dbc0f875a0cd88 — Environment-variable access.
repo/lib/streamlit/runtime/app_session.py:861 
            "DISPLAY" in os.environ or "WAYLAND_DISPLAY" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe89aa407a68ebb1 — Environment-variable access.
repo/lib/streamlit/runtime/connection_factory.py:420 
        name = os.environ[envvar_name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e264c5a302a3283 — Environment-variable access.
repo/lib/streamlit/runtime/credentials.py:50 
        not env_util.IS_WINDOWS or os.environ.get("WT_SESSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #28f3da7101360d82 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/lib/streamlit/runtime/credentials.py:78 
        response_json = requests.get(
            "https://data.streamlit.io/metrics.json", timeout=2
        ).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #57dcfa2c434dc9ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/lib/streamlit/runtime/credentials.py:104 
    response = requests.post(
        metrics_url,
        headers=headers,
        data=json.dumps(data).encode(),
        timeout=10,
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #7b4f99cb93f1132a — Filesystem access.
repo/lib/streamlit/runtime/credentials.py:151 
            with open(self._conf_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #995296ee9e917f11 — Filesystem access.
repo/lib/streamlit/runtime/credentials.py:221 
        with open(self._conf_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b02f0b624ae6a622 — Filesystem access.
repo/lib/streamlit/runtime/memory_media_file_storage.py:205 
            with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #20e4503bb3c41064 — Filesystem access.
repo/lib/streamlit/runtime/metrics_util.py:255 
        with open(_ETC_MACHINE_ID_PATH, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0fb1f3c24b89dddb — Filesystem access.
repo/lib/streamlit/runtime/metrics_util.py:259 
        with open(_DBUS_MACHINE_ID_PATH, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8b97ccbc8a21a201 — Filesystem access.
repo/lib/streamlit/runtime/secrets.py:307 
            with open(path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #110ad203927c5253 — Filesystem access.
repo/lib/streamlit/runtime/secrets.py:363 
                with open(file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b76d015a24cbad9 — Environment-variable access.
repo/lib/streamlit/runtime/secrets.py:513 
            os.environ[k] = str(v)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f366684e72eb53b — Environment-variable access.
repo/lib/streamlit/runtime/secrets.py:522 
        if value_type in {str, int, float} and os.environ.get(k) == str(v):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b45df19bf8e5cb0 — Environment-variable access.
repo/lib/streamlit/runtime/secrets.py:523 
            del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3bcdd697f3cd5d14 — Filesystem access.
repo/lib/streamlit/source_util.py:55 
    return open(filename, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c6f9ca738b05081e — Filesystem access.
repo/lib/streamlit/testing/v1/app_test.py:231 
        path.write_text(aligned_script, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fba57553fd0a1dbf — Filesystem access.
repo/lib/streamlit/watcher/util.py:173 
    with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #58d70a8ef13cd4c4 — Environment-variable access.
repo/lib/streamlit/web/bootstrap.py:137 
    if "MAPBOX_API_KEY" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd38c719b02ed052 — Environment-variable access.
repo/lib/streamlit/web/bootstrap.py:138 
        os.environ["MAPBOX_API_KEY"] = config.get_option("mapbox.token")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4edd135f1244bae1 — Filesystem access.
repo/lib/streamlit/web/cli.py:122 
    with open(main_script_path, "wb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #d3255169d126ff3b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/lib/streamlit/web/cli.py:124 
            resp = requests.get(url_path, timeout=30)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #8dc8a41eed99abd1 — Filesystem access.
repo/lib/streamlit/web/cli.py:586 
    (project_dir / "requirements.txt").write_text("streamlit\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94f3e0dcdda200cd — Filesystem access.
repo/lib/streamlit/web/cli.py:589 
    (project_dir / "streamlit_app.py").write_text(
        """import streamlit as st

st.title("🎈 My new app")
st.write(
    "Let's start building! For help and inspiration, head over to [docs.streamlit.io](https://docs.streamlit.io/)."
)
""",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2b414bee476d3ca1 — Filesystem access.
repo/lib/streamlit/web/server/app_discovery.py:365 
        source = path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2215598d4fa8de3f — Environment-variable access.
repo/lib/streamlit/web/server/server_util.py:191 
            port_str = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #219cc813bdaf58fa — Filesystem access.
repo/lib/streamlit/web/skills.py:276 
        if (target_path / rel_path).read_bytes() != source_file.read_bytes():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

pyarrow

python dependency
medium pii_flow tooling reachable #873daccad7495c0d — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:63 · flow /tmp/closeopen-gqtzl0z0/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:60 → /tmp/closeopen-gqtzl0z0/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:63 
                          headers=headers,

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow tooling reachable #b2dae17d6160dce5 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:77 · flow /tmp/closeopen-gqtzl0z0/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:74 → /tmp/closeopen-gqtzl0z0/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:77 
                          headers=headers,

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 21 low-confidence finding(s)
low env_fs tooling reachable #cb29f2ad4fb7cc7d — Filesystem access.
pkgs/python/[email protected]/examples/flight/client.py:168 
            with open(args.tls_roots, "rb") as root_certs:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #891c23e26a35dfe2 — Filesystem access.
pkgs/python/[email protected]/examples/flight/client.py:171 
        with open(args.mtls[0], "rb") as cert_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #aae3315939a5f938 — Filesystem access.
pkgs/python/[email protected]/examples/flight/client.py:173 
        with open(args.mtls[1], "rb") as key_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #77ee00eb36194a3a — Filesystem access.
pkgs/python/[email protected]/examples/flight/server.py:137 
        with open(args.tls[0], "rb") as cert_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #3bb46420ed95af87 — Filesystem access.
pkgs/python/[email protected]/examples/flight/server.py:139 
        with open(args.tls[1], "rb") as key_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling reachable #315bc2b528c6cabd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:62 
        r = requests.post(endpoint + master_key_identifier,
                          headers=headers,
                          data={'plaintext': base64.b64encode(key_bytes)})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling reachable #31d15f1197cec5c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:76 
        r = requests.post(endpoint + master_key_identifier,
                          headers=headers,
                          data={'ciphertext': wrapped_key})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling reachable #5fb8d4f2c194f950 — Environment-variable access.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:117 
        kms_instance_url=os.environ.get('VAULT_URL', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #f7447a0b1c0ba89c — Environment-variable access.
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:118 
        key_access_token=os.environ.get('VAULT_TOKEN', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e691e1f8946a26c7 — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:316 
    return _os.environ.get('PKG_CONFIG', 'pkg-config')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9411401b1a80820b — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:409 
    pkg_config_executable = _os.environ.get('PKG_CONFIG') or 'pkg-config'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32f1f53de34ce8ba — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:441 
    if _os.environ.get('ARROW_HOME'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be2966c502b56bf5 — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:442 
        append_library_dir(_os.path.join(_os.environ['ARROW_HOME'], 'lib'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a412fe5a897f140e — Environment-variable access.
pkgs/python/[email protected]/pyarrow/ipc.py:138 
        bool(int(os.environ.get('ARROW_PRE_0_15_IPC_FORMAT', '0')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df9504883dd4a997 — Environment-variable access.
pkgs/python/[email protected]/pyarrow/ipc.py:139 
    if bool(int(os.environ.get('ARROW_PRE_1_0_METADATA_VERSION', '0'))):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #1e233fde3b51ccf6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pyarrow/util.py:236 
    with urlopen(req) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #df34892e369387a3 — Filesystem access.
pkgs/python/[email protected]/pyarrow/util.py:237 
        with open(out_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c38ee45b2fa1df5c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pyarrow/util.py:243 
    with requests.get(url) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #fc9fd666ab5f1486 — Filesystem access.
pkgs/python/[email protected]/pyarrow/util.py:244 
        with open(out_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #e956efe77932c242 — Filesystem access.
pkgs/python/[email protected]/scripts/update_stub_docstrings.py:200 
        tree = libcst.parse_module(stub_file.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #a98a67895c3193e0 — Filesystem access.
pkgs/python/[email protected]/scripts/update_stub_docstrings.py:202 
        stub_file.write_text(modified.code, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@streamlit/component-v2-lib

python dependency
expand_more 5 low-confidence finding(s)
low egress tooling reachable #89727ae88d2661d9 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/@[email protected]__reposrc/examples/periodic_table.py:88 
    img_bytes = urllib.request.urlopen(img_url).read()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #0743aa7594d0d241 — Filesystem access.
pkgs/python/@[email protected]__reposrc/local/server/streamlit/local/config.py:19 
        with open(__LOCAL_CONFIG_PATH) as config_stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5e6278a4ec027c0 — Filesystem access.
pkgs/python/@[email protected]__reposrc/local/server/streamlit/local/config.py:39 
    with open(__LOCAL_CONFIG_PATH, 'w') as config_stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e91777c0cff4298 — Filesystem access.
pkgs/python/@[email protected]__reposrc/local/server/streamlit/local/config.py:51 
        with open(__LOCAL_CONFIG_PATH) as config_stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d74d3ed76b3d2c8 — Filesystem access.
pkgs/python/@[email protected]__reposrc/shared/server/config.py:48 
    with open(config_file_name) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

SQLAlchemy

python dependency
expand_more 29 low-confidence finding(s)
low egress dependency Excluded from app score #55642b3dc22bc5a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/lib/sqlalchemy/pool/impl.py:145 
            self._pool.put(record, False)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling reachable #dbeafaf4d366bb22 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:42 
            with open(
                Path(cachedir) / "sqla_mypy_config.cfg", "w"
            ) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #2fa45a244e74a86a — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:56 
            with open(
                Path(cachedir) / "plain_mypy_config.cfg", "w"
            ) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #0f3b6260675ec4a0 — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:106 
            os.environ.pop("MYPY_FORCE_COLOR", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #b5744405e8504f4f — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:146 
        with open(path) as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2686c2a9ae4e7e4 — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/plugin_base.py:398 
    if os.environ.get("REQUIRE_SQLALCHEMY_CEXT", "0") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cdce6482fe16cb4 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/plugin_base.py:455 
            with open(options.write_idents, "a") as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03e9e5ae0d23c87f — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/pytestplugin.py:880 
        return os.environ.get("PYTEST_CURRENT_TEST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c838d3ed60ee15f — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/profiling.py:200 
            profile_f = open(self.fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5b22939ce1fd0ef — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/profiling.py:219 
        profile_f = open(self.fname, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a62de7897619ffe3 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/provision.py:453 
    with open(idents_file) as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5a88d8fb92f834f — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/util/_has_cy.py:27 
    if os.environ.get("DISABLE_SQLALCHEMY_CEXT_RUNTIME"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a949314e3342d811 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:134 
            Path(destination_path).write_text(
                text, encoding="utf-8", newline="\n"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3ac6ca98e5440fc — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:146 
            with open(tempfile) as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15cf5f964ccca1d0 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:162 
            with open(source_file, encoding="utf-8") as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1ad914ac6a83827 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:169 
        with open(destination_path, encoding="utf-8") as dp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5baf9f437f865fd8 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:95 
    cmd.extend(os.environ.get(dburl_env, default_dburl).split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3900c81fd2e3eaa4 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:106 
    env_dbdrivers = os.environ.get(extra_driver_env, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3556245aef79f8fe — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:269 
    cmd.extend(os.environ.get("TOX_WORKERS", "-n4").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc7ecf511cab8b81 — Environment-variable access.
pkgs/python/[email protected]/setup.py:23 
DISABLE_EXTENSION = bool(os.environ.get("DISABLE_SQLALCHEMY_CEXT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ab03fbb68f2868e — Environment-variable access.
pkgs/python/[email protected]/setup.py:24 
REQUIRE_EXTENSION = bool(os.environ.get("REQUIRE_SQLALCHEMY_CEXT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #8c0265de9e91c8a0 — Filesystem access.
pkgs/python/[email protected]/tools/format_docs_code.py:155 
    original = file.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #2a9a991543022ca4 — Filesystem access.
pkgs/python/[email protected]/tools/format_docs_code.py:313 
                file.write_text(updated, "utf-8", newline="\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #f2c9ba5783fa5626 — Filesystem access.
pkgs/python/[email protected]/tools/generate_proxy_methods.py:145 
    with open(fn.__code__.co_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #cbc8059ff6cd8d66 — Filesystem access.
pkgs/python/[email protected]/tools/generate_proxy_methods.py:373 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #a95b93222ead5cdf — Filesystem access.
pkgs/python/[email protected]/tools/generate_sql_functions.py:38 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #f991b3484934d34f — Filesystem access.
pkgs/python/[email protected]/tools/generate_tuple_map_overloads.py:53 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #7009c3764f399cdd — Filesystem access.
pkgs/python/[email protected]/tools/normalize_file_headers.py:27 
    content = file.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #0b7164d6203abf9c — Filesystem access.
pkgs/python/[email protected]/tools/sync_test_files.py:35 
    source_data = Path(source).read_text().replace(remove_str, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

altair

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #53f2cf541052d561 — Environment-variable access.
pkgs/python/[email protected]/altair/datasets/_cache.py:307 
        Path(os.environ.get("XDG_CACHE_HOME", Path.home() / ".cache")) / "altair"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #b73521960a9fe3ae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/altair/datasets/_cache.py:365 
        with self._rd._opener.open(url) as f:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #59e16056425d89de — Environment-variable access.
pkgs/python/[email protected]/altair/datasets/_cache.py:401 
        fp = Path(usr) if (usr := os.environ.get(self._ENV_VAR)) else self._XDG_CACHE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a7c5ec93db421ea — Environment-variable access.
pkgs/python/[email protected]/altair/datasets/_cache.py:408 
            os.environ[self._ENV_VAR] = str(Path(source).resolve())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2284945e82387b6 — Environment-variable access.
pkgs/python/[email protected]/altair/datasets/_cache.py:410 
            os.environ[self._ENV_VAR] = ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56e6bdcda1218517 — Environment-variable access.
pkgs/python/[email protected]/altair/datasets/_cache.py:429 
        return os.environ.get(self._ENV_VAR) == ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #3e70f932274d547e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/altair/datasets/_reader.py:223 
            with self._opener.open(meta["url"]) as f:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #2b7252c39406c860 — Filesystem access.
pkgs/python/[email protected]/altair/jupyter/jupyter_chart.py:95 
    return (_here / "js" / "index.js").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #213a6a5d60e06bbc — Filesystem access.
pkgs/python/[email protected]/altair/utils/data.py:308 
    Path(filename).write_text(data, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

anyio

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #0d597fb839fd1e6b — Filesystem access.
pkgs/python/[email protected]/src/anyio/to_process.py:212 
    sys.stdin = open(os.devnull)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c39eda3c06a191f — Filesystem access.
pkgs/python/[email protected]/src/anyio/to_process.py:213 
    sys.stdout = open(os.devnull, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b5fa9b4c9e4de75 — Filesystem access.
pkgs/python/[email protected]/src/anyio/to_process.py:214 
    sys.stderr = open(os.devnull, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

click

python dependency
expand_more 31 low-confidence finding(s)
low env_fs dependency Excluded from app score #aa4498c91a399f9a — Filesystem access.
pkgs/python/[email protected]/src/click/_compat.py:366 
        return open(file, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #294f0c1a8fc084c1 — Filesystem access.
pkgs/python/[email protected]/src/click/_compat.py:368 
    return open(file, mode, encoding=encoding, errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae69db2793631baa — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:418 
    pager_cmd_parts = shlex.split(os.environ.get("PAGER", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af302bd7c0a02a32 — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:424 
    if os.environ.get("TERM") in ("dumb", "emacs"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a50de92f42e9619f — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:516 
    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #156b54aa03e60bc7 — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:521 
        less_flags = f"{os.environ.get('LESS', '')}{' '.join(cmd_params)}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b795a13c36ec3f19 — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:673 
            rv = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94b99168e6b2b742 — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:695 
            environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d67b3ec05e7f476 — Filesystem access.
pkgs/python/[email protected]/src/click/_termui_impl.py:761 
            with open(name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dbabde974f1e951 — Filesystem access.
pkgs/python/[email protected]/src/click/_termui_impl.py:790 
        null = open("/dev/null", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59b7d2fa40f3e33e — Filesystem access.
pkgs/python/[email protected]/src/click/_termui_impl.py:916 
            f = open("/dev/tty")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5582333edc65c7e — Filesystem access.
pkgs/python/[email protected]/src/click/core.py:1243 
                formatter.write_text(text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da950df3cc7c3347 — Filesystem access.
pkgs/python/[email protected]/src/click/core.py:1264 
                formatter.write_text(epilog)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e59e7377c04e38a6 — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:1557 
        instruction = os.environ.get(complete_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #128fb0350fe0239f — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:2631 
            rv = os.environ.get(self.envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d91c3ae7dd858aa — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:2637 
                rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc656389e1947ebe — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:3402 
            rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01e5bf6988618b5b — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:371 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fcee9d030e881f8a — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:372 
        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad920cd1f32f1e5c — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:393 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba0e36c716243533 — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:394 
        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3d08f8a7407f5cc — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:429 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8a9a463e5f7647a — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:430 
        incomplete = os.environ["COMP_CWORD"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa6104b99cd8f231 — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:567 
                old_env[key] = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a50cae83c5485abf — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:570 
                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #214f09728e58b271 — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:574 
                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #476849338209ab1e — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:580 
                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #497f3ad92e2b6964 — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:584 
                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #829ad49356ae2c00 — Filesystem access.
pkgs/python/[email protected]/src/click/utils.py:149 
                open(filename, mode).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1508f37f33a474a — Environment-variable access.
pkgs/python/[email protected]/src/click/utils.py:506 
        folder = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a73d8f5b3660fee — Environment-variable access.
pkgs/python/[email protected]/src/click/utils.py:517 
        os.environ.get("XDG_CONFIG_HOME", os.path.expanduser("~/.config")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gitpython

python dependency
expand_more 55 low-confidence finding(s)
low env_fs dependency Excluded from app score #7cbeaf43990dc0e8 — Filesystem access.
pkgs/python/[email protected]/doc/source/conf.py:50 
with open(os.path.join(os.path.dirname(__file__), "..", "..", "VERSION")) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bfb86f3f1b5cf70 — Environment-variable access.
pkgs/python/[email protected]/git/cmd.py:668 
    GIT_PYTHON_TRACE = os.environ.get("GIT_PYTHON_TRACE", False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ceac01bb7b9348c — Environment-variable access.
pkgs/python/[email protected]/git/cmd.py:784 
            new_git = os.environ.get(cls._git_exec_env_var, cls.git_exec_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05063d4ed60f5926 — Environment-variable access.
pkgs/python/[email protected]/git/cmd.py:833 
                mode = os.environ.get(cls._refresh_env_var, "raise").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7864322d9c2f2cf — Environment-variable access.
pkgs/python/[email protected]/git/cmd.py:1369 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97ec1574a523b980 — Filesystem access.
pkgs/python/[email protected]/git/cmd.py:1391 
        stdout_sink = PIPE if with_stdout else getattr(subprocess, "DEVNULL", None) or open(os.devnull, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3363e8389a87312f — Environment-variable access.
pkgs/python/[email protected]/git/config.py:259 
        config_home = os.environ.get("XDG_CONFIG_HOME") or osp.join(os.environ.get("HOME", "~"), ".config")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7c2db1eb6144047 — Filesystem access.
pkgs/python/[email protected]/git/config.py:652 
                    with open(file_path, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a2dbfe77e709382 — Filesystem access.
pkgs/python/[email protected]/git/config.py:770 
            with open(fp, "wb") as fp_open:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30dd520c25c76b42 — Filesystem access.
pkgs/python/[email protected]/git/index/base.py:705 
                return open(filepath, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc1dd2bbf9ff34be — Filesystem access.
pkgs/python/[email protected]/git/index/base.py:1180 
        with open(self._commit_editmsg_filepath(), "wb") as commit_editmsg_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd794f1f08d41f69 — Filesystem access.
pkgs/python/[email protected]/git/index/base.py:1187 
        with open(self._commit_editmsg_filepath(), "rb") as commit_editmsg_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4eb92f5cd281b50 — Environment-variable access.
pkgs/python/[email protected]/git/index/fun.py:100 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #076106f3a9c82b13 — Environment-variable access.
pkgs/python/[email protected]/git/objects/commit.py:681 
        env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1e0b5a431b0356b — Filesystem access.
pkgs/python/[email protected]/git/objects/submodule/base.py:429 
        with open(git_file, "wb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cf6fdae585ef77b — Filesystem access.
pkgs/python/[email protected]/git/refs/log.py:267 
        with open(filepath, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4df88a43a612140f — Filesystem access.
pkgs/python/[email protected]/git/refs/log.py:363 
            fd = open(filepath, "ab")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e53a0b48b6eb0b1b — Filesystem access.
pkgs/python/[email protected]/git/refs/symbolic.py:152 
            with open(cls._get_packed_refs_path(repo), "rt", encoding="UTF-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a49c4dc24294dd6f — Filesystem access.
pkgs/python/[email protected]/git/refs/symbolic.py:265 
            with open(os.path.join(repodir, ref_path), "rt", encoding="UTF-8") as fp:  # type: ignore[arg-type]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89f8fbc218bdbe84 — Filesystem access.
pkgs/python/[email protected]/git/refs/symbolic.py:668 
                with open(pack_file_path, "rb") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96662854ab0fff70 — Filesystem access.
pkgs/python/[email protected]/git/refs/symbolic.py:696 
                    with open(pack_file_path, "wb") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ce191750a7c2687 — Filesystem access.
pkgs/python/[email protected]/git/refs/symbolic.py:738 
            with open(abs_ref_path, "rb") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c67b412e56600d63 — Filesystem access.
pkgs/python/[email protected]/git/refs/symbolic.py:822 
                with open(new_abs_path, "rb") as fd1:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f4b04c960424137 — Filesystem access.
pkgs/python/[email protected]/git/refs/symbolic.py:824 
                with open(cur_abs_path, "rb") as fd2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3058b1cc41b0fb63 — Filesystem access.
pkgs/python/[email protected]/git/remote.py:918 
        with open(fetch_head.abspath, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #561b4e38859320c8 — Environment-variable access.
repo/base.py:230 
        epath = path or os.getenv("GIT_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2113589263f1f525 — Environment-variable access.
repo/base.py:266 
                if "GIT_WORK_TREE" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #615580a27bcf119e — Environment-variable access.
repo/base.py:267 
                    self._working_tree_dir = os.getenv("GIT_WORK_TREE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #417cc38e20faf8d4 — Filesystem access.
repo/base.py:271 
                    with open(osp.join(git_dir, "gitdir")) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ecdf540414f3e41 — Environment-variable access.
repo/base.py:294 
                if os.environ.get("GIT_COMMON_DIR") is None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10eb46eff421e27b — Environment-variable access.
repo/base.py:298 
                if "GIT_WORK_TREE" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e4635eef8676e58 — Environment-variable access.
repo/base.py:299 
                    self._working_tree_dir = os.getenv("GIT_WORK_TREE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa353ddc620af3c2 — Filesystem access.
repo/base.py:336 
            common_dir = (Path(self.git_dir) / "commondir").read_text().splitlines()[0].strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5069c31f4bbc125a — Filesystem access.
repo/base.py:397 
        with open(filename, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df672ce63eac7eea — Filesystem access.
repo/base.py:403 
        with open(filename, "wb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a713f93116d921f4 — Environment-variable access.
repo/base.py:678 
            config_home = os.environ.get("XDG_CONFIG_HOME") or osp.join(os.environ.get("HOME", "~"), ".config")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #809333b9dfef99b3 — Filesystem access.
repo/base.py:952 
            with open(alternates_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b30b16daa9ce2b2 — Filesystem access.
repo/base.py:975 
            with open(alternates_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #808c59852ed26c4c — Filesystem access.
repo/base.py:1729 
        with open(rebase_head_file, "rt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a18dd67436757f34 — Filesystem access.
repo/fun.py:55 
    with open(filename, "ab"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d12c92a489eddc4 — Environment-variable access.
repo/fun.py:69 
        if (osp.isdir(osp.join(d, "objects")) or "GIT_OBJECT_DIRECTORY" in os.environ) and osp.isdir(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4705db8faa35e90 — Filesystem access.
repo/fun.py:93 
        lines = Path(dotgit).read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbd1373e037ff607 — Filesystem access.
repo/fun.py:108 
        with open(d) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9b6b25f0821b22b — Environment-variable access.
pkgs/python/[email protected]/git/util.py:122 
        value = os.environ[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5a7a70704aa86ce — Environment-variable access.
pkgs/python/[email protected]/git/util.py:201 
    old_value = os.getenv(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8dfdffd357949604 — Environment-variable access.
pkgs/python/[email protected]/git/util.py:202 
    os.environ[name] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de7ff2c3e4c03c2e — Environment-variable access.
pkgs/python/[email protected]/git/util.py:207 
            del os.environ[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7b2d8e6cf301cff — Environment-variable access.
pkgs/python/[email protected]/git/util.py:209 
            os.environ[name] = old_value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23d1a7d1b1052004 — Environment-variable access.
pkgs/python/[email protected]/git/util.py:338 
    PATHEXT = os.environ.get("PATHEXT", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e44af8963c2d1a6e — Environment-variable access.
pkgs/python/[email protected]/git/util.py:374 
        path = os.environ["PATH"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac378389c7f8ea84 — Environment-variable access.
pkgs/python/[email protected]/git/util.py:870 
                val = os.environ[evar]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d269bbf8f19994f — Filesystem access.
pkgs/python/[email protected]/git/util.py:1060 
            with open(lock_file, mode="w"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6aa7e6c5e8356030 — Filesystem access.
pkgs/python/[email protected]/setup.py:14 
    return (Path(__file__).parent / path).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2f358a99fbac5ac — Filesystem access.
pkgs/python/[email protected]/setup.py:49 
        with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e997499928342e33 — Filesystem access.
pkgs/python/[email protected]/setup.py:59 
        with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httptools

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #59ed030029b838f2 — Filesystem access.
pkgs/python/[email protected]/setup.py:143 
with open(str(ROOT / 'httptools' / '_version.py')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

katex

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #e83862ea5e3d64c1 — Filesystem access.
pkgs/python/[email protected]/src/metrics/parse_tfm.py:134 
    with open(file_name, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

orjson

python dependency
expand_more 40 low-confidence finding(s)
low env_fs dependency Excluded from app score #b1ec574548911b3a — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:118 
data = json.load(open("../encoding/encodings.json", "r"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d10c92638719550 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:120 
indexes = json.load(open("../encoding/indexes.json", "r"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #325e8342cffe6855 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:366 
  partially_generated_file = open(path, "r")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #521a16c2ddeb8b2c — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:387 
label_file = open("src/lib.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06bbe377add78a4e — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:405 
  docfile = open("doc/%s.txt" % name, "r")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cededdeb782a7e8 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:457 
label_test_file = open("src/test_labels_names.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13be3cd5fc2f1d0b — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:484 
data_file = open("src/data.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1dc19f180f7b1aa — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1173 
variant_file = open("src/variant.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae95fee628e8165b — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1417 
ffi_file = open("../encoding_c/src/lib.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8716f948edb7c536 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1440 
single_byte_file = open("src/single_byte.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d8fe9512cc841a5 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1494 
static_file = open("../encoding_c/include/encoding_rs_statics.h", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22cd03b503ae1d2a — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1560 
utf_8_file = open("src/utf_8.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11b8e5a48cb7d04a — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1623 
jis0208_in_file = open("src/test_data/jis0208_in.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0ccaefdd72489f9 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1632 
jis0208_in_ref_file = open("src/test_data/jis0208_in_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b4dc7ae2792f9cf — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1642 
jis0208_out_file = open("src/test_data/jis0208_out.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e85d5cc6e485a33 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1643 
jis0208_out_ref_file = open("src/test_data/jis0208_out_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46ba0f436a2390da — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1660 
shift_jis_in_file = open("src/test_data/shift_jis_in.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2a9686cd6bb0101 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1669 
shift_jis_in_ref_file = open("src/test_data/shift_jis_in_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2cd0e4f9367a77fa — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1684 
shift_jis_out_file = open("src/test_data/shift_jis_out.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c3f1e16c548067e — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1685 
shift_jis_out_ref_file = open("src/test_data/shift_jis_out_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0125b87efaf71914 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1713 
iso_2022_jp_in_file = open("src/test_data/iso_2022_jp_in.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #089f7e3775dd972e — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1722 
iso_2022_jp_in_ref_file = open("src/test_data/iso_2022_jp_in_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45c4a4962517df24 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1732 
iso_2022_jp_out_file = open("src/test_data/iso_2022_jp_out.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bb3fe2b0a4effbf — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1733 
iso_2022_jp_out_ref_file = open("src/test_data/iso_2022_jp_out_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd24a263a5fb093d — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1761 
euc_kr_in_file = open("src/test_data/euc_kr_in.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb7a014289567d8d — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1770 
euc_kr_in_ref_file = open("src/test_data/euc_kr_in_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c88295a0cd6ab8b — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1785 
euc_kr_out_file = open("src/test_data/euc_kr_out.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fedf76573aeff76 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1786 
euc_kr_out_ref_file = open("src/test_data/euc_kr_out_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6071968a73824584 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1802 
gb18030_in_file = open("src/test_data/gb18030_in.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #241b9ac8c0189df8 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1811 
gb18030_in_ref_file = open("src/test_data/gb18030_in_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e4d74346ee2af14 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1826 
gb18030_out_file = open("src/test_data/gb18030_out.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #989f9d4e887637e2 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1827 
gb18030_out_ref_file = open("src/test_data/gb18030_out_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08a3003b52b84c79 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1845 
big5_in_file = open("src/test_data/big5_in.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65b0a560b2958a8e — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1861 
big5_in_ref_file = open("src/test_data/big5_in_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d0becd163f621a0 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1898 
big5_out_file = open("src/test_data/big5_out.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f38709b23695a5c5 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1899 
big5_out_ref_file = open("src/test_data/big5_out_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f5a218baba3f13d — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1921 
jis0212_in_file = open("src/test_data/jis0212_in.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #970a25f8d636343b — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1930 
jis0212_in_ref_file = open("src/test_data/jis0212_in_ref.txt", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cffa58431300f66a — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1942 
codepage_file = open("../codepage/src/lib.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56fa58d84c195cb0 — Filesystem access.
pkgs/python/[email protected]/include/cargo/encoding_rs-0.8.35/generate-encoding-data.py:1974 
codepage_test_file = open("../codepage/src/tests.rs", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

packaging

python dependency
expand_more 3 low-confidence finding(s)
low env_fs tooling reachable #2b53f40bd092406e — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:11 
with open(os.path.join(_BASE_DIR, "src", "packaging", "__init__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c8e36f7c5b03df2 — Filesystem access.
pkgs/python/[email protected]/src/packaging/_manylinux.py:34 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32b2934978004f19 — Filesystem access.
pkgs/python/[email protected]/src/packaging/_musllinux.py:46 
        with open(executable, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pandas

python dependency
expand_more 29 low-confidence finding(s)
low env_fs dependency Excluded from app score #0a83ef92f9a55784 — Filesystem access.
pkgs/python/[email protected]/generate_pxi.py:8 
    with open(pxifile, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5052e36c6b1dbf1 — Filesystem access.
pkgs/python/[email protected]/generate_pxi.py:12 
    with open(outfile, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96dca361605f2bc1 — Environment-variable access.
pkgs/python/[email protected]/generate_version.py:25 
    if os.environ.get("MESON_DIST_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41d78c1c2648e770 — Environment-variable access.
pkgs/python/[email protected]/generate_version.py:26 
        path = os.path.join(os.environ.get("MESON_DIST_ROOT"), path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0ed249b73efcaab — Filesystem access.
pkgs/python/[email protected]/generate_version.py:27 
    with open(path, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #153c53366ad1cff7 — Environment-variable access.
pkgs/python/[email protected]/pandas/_testing/contexts.py:76 
                    del os.environ["TZ"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a729a157a865e2a — Environment-variable access.
pkgs/python/[email protected]/pandas/_testing/contexts.py:80 
                os.environ["TZ"] = tz

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3eaa555dba66bfd3 — Environment-variable access.
pkgs/python/[email protected]/pandas/_testing/contexts.py:85 
    orig_tz = os.environ.get("TZ")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb4903a786a47055 — Filesystem access.
pkgs/python/[email protected]/pandas/_version.py:159 
        with open(versionfile_abs, encoding="utf-8") as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cd153458e01d6a1 — Environment-variable access.
pkgs/python/[email protected]/pandas/_version.py:264 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2eb20187de79f280 — Environment-variable access.
pkgs/python/[email protected]/pandas/compat/__init__.py:154 
    return os.environ.get("PANDAS_CI", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e528a432dee410a4 — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:425 
        if os.environ.get("PANDAS_COPY_ON_WRITE", "0") == "warn"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ee98b0174830152 — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:426 
        else os.environ.get("PANDAS_COPY_ON_WRITE", "1") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd0c160c779d12d3 — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:878 
        False if os.environ.get("PANDAS_FUTURE_INFER_STRING", "1") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f5414899d147445 — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:895 
        os.environ.get("PANDAS_FUTURE_DISTINGUISH_NAN_AND_NA", "0") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e36c2e4093c3ae6e — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:906 
        False if os.environ.get("PANDAS_FUTURE_PYTHON_SCALARS", "0") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7da4278138b8510 — Filesystem access.
pkgs/python/[email protected]/pandas/core/series.py:1573 
            with open(buf, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1dce4b7b6955e473 — Environment-variable access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:74 
HAS_DISPLAY = os.getenv("DISPLAY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83a58b515db47a81 — Filesystem access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:302 
        with open("/dev/clipboard", "w", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff868fd4f912a745 — Filesystem access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:306 
        with open("/dev/clipboard", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4b15f2719b6da9e — Environment-variable access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:569 
        if os.environ.get("WAYLAND_DISPLAY") and _executable_exists("wl-copy"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #106a3858760970de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pandas/io/common.py:282 
    return urllib.request.urlopen(*args, **kwargs)  # noqa: TID251

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #7c69b1b0328835d4 — Filesystem access.
pkgs/python/[email protected]/pandas/io/common.py:930 
            handle = open(
                handle,
                ioargs.mode,
                encoding=ioargs.encoding,
                errors=errors,
                newline="",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7e8fd51fdb34854 — Filesystem access.
pkgs/python/[email protected]/pandas/io/common.py:939 
            handle = open(handle, ioargs.mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74beb34f97008e02 — Filesystem access.
pkgs/python/[email protected]/pandas/io/common.py:1192 
        handle = open(handle, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7c8cc68c9657230 — Filesystem access.
pkgs/python/[email protected]/pandas/io/formats/format.py:1076 
        with open(buf, "w", encoding=encoding, newline="") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73099a62688b2db6 — Environment-variable access.
pkgs/python/[email protected]/pandas/util/_print_versions.py:57 
        "LC_ALL": os.environ.get("LC_ALL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3228c3d5dbdbf8ff — Environment-variable access.
pkgs/python/[email protected]/pandas/util/_print_versions.py:58 
        "LANG": os.environ.get("LANG"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4c80558986c3906 — Filesystem access.
pkgs/python/[email protected]/pandas/util/_print_versions.py:148 
            with open(as_json, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

protobuf

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #a1d96fa23e60e1d2 — Environment-variable access.
pkgs/python/[email protected]/google/protobuf/internal/api_implementation.py:65 
_implementation_type = os.getenv('PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION',
                                 _implementation_type)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7317d76f8356ad2 — Environment-variable access.
pkgs/python/[email protected]/google/protobuf/runtime_version.py:71 
  disable_flag = os.getenv('TEMPORARILY_DISABLE_PROTOBUF_VERSION_CHECK')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e0f4a0190392809 — Filesystem access.
pkgs/python/[email protected]/setup.py:28 
  with open(os.path.join('google', 'protobuf', '__init__.py')) as version_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pydeck

python dependency
expand_more 13 low-confidence finding(s)
low env_fs tooling reachable #ccf32b6555a7ccbb — Environment-variable access.
pkgs/python/[email protected]/examples/terrain_layer.py:12 
MAPBOX_API_KEY = os.environ.get("MapboxAccessToken") or os.environ.get("MAPBOX_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcb161b523cd2641 — Environment-variable access.
pkgs/python/[email protected]/pydeck/bindings/deck.py:172 
                    attr_value = os.getenv(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #899e940af5d54d2d — Environment-variable access.
pkgs/python/[email protected]/pydeck/io/html.py:42 
    dev_port = os.getenv("PYDECK_DEV_PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24a25e91c4832047 — Filesystem access.
pkgs/python/[email protected]/pydeck/io/html.py:51 
        with open(join(dirname(__file__), RELPATH_TO_BUNDLE), "r", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b37465718100cc75 — Filesystem access.
pkgs/python/[email protected]/pydeck/io/html.py:156 
        with open(filename, "w+", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc5c336fe22800c4 — Filesystem access.
pkgs/python/[email protected]/pydeck/types/image.py:50 
            with open(os.path.expanduser(self.path), "rb") as img_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57a27e926be7b145 — Filesystem access.
pkgs/python/[email protected]/setup.py:20 
with open(os.path.join(here, "pydeck", "_version.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fce936932b624632 — Filesystem access.
pkgs/python/[email protected]/setup.py:25 
    return open(os.path.join(here, *parts), "r").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b87badbda9e67de — Environment-variable access.
pkgs/python/[email protected]/setup.py:32 
log.info("$PATH=%s" % os.environ["PATH"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c9a3822baa5e24a — Environment-variable access.
pkgs/python/[email protected]/setup.py:41 
    [os.path.join(PATH_TO_REPO_ROOT, "node_modules", ".bin"), os.environ.get("PATH", os.defpath)]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #298be7e157f30a94 — Filesystem access.
pkgs/python/[email protected]/setup.py:100 
            check_call(["npm", "--version"], stdout=open(os.devnull, "wb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33a93ca1ae448467 — Filesystem access.
pkgs/python/[email protected]/setup.py:101 
            check_call(["yarn", "--version"], stdout=open(os.devnull, "wb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51f8aa9552e51ba9 — Environment-variable access.
pkgs/python/[email protected]/setup.py:124 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-multipart

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #800889c49bd20ac6 — Filesystem access.
pkgs/python/[email protected]/python_multipart/multipart.py:516 
                tmp_file = open(path, "w+b")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

requests

python dependency
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #f6668cefe0d4f49f — Environment-variable access.
pkgs/python/[email protected]/src/requests/sessions.py:857 
                    os.environ.get("REQUESTS_CA_BUNDLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee77d6c445a8e0cb — Environment-variable access.
pkgs/python/[email protected]/src/requests/sessions.py:858 
                    or os.environ.get("CURL_CA_BUNDLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d9b4e37507812cd — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:239 
    netrc_file = os.environ.get("NETRC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bb79b9616f8c93a — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:798 
        old_value = os.environ.get(env_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad7f1fde904f3090 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:799 
        os.environ[env_name] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #391353393ca6bac9 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:805 
                del os.environ[env_name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a84fbae112bd077 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:807 
                os.environ[env_name] = old_value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd0ddfa162927067 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:820 
        return os.environ.get(key) or os.environ.get(key.upper())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

starlette

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #655c1211b2b55a0b — Environment-variable access.
pkgs/python/[email protected]/starlette/config.py:19 
    def __init__(self, environ: MutableMapping[str, str] = os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f05dcddaa02b707 — Filesystem access.
pkgs/python/[email protected]/starlette/config.py:113 
        with open(file_name, encoding=encoding) as input_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

toml

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #11ae04f090722b33 — Filesystem access.
pkgs/python/[email protected]/setup.py:8 
with open("README.rst") as readme_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a21cde4f9bd92cdc — Filesystem access.
pkgs/python/[email protected]/toml/decoder.py:133 
        with io.open(_getpath(f), encoding='utf-8') as ffile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

typing-extensions

python dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #3df93a78e36f4170 — Filesystem access.
pkgs/python/[email protected]/src/test_typing_extensions.py:1698 
            Path(tempdir, "ann_module.py").write_text(ANN_MODULE_SOURCE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd8cdc08b7907910 — Filesystem access.
pkgs/python/[email protected]/src/test_typing_extensions.py:1699 
            Path(tempdir, "ann_module2.py").write_text(ANN_MODULE_2_SOURCE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bbff97012547e03 — Filesystem access.
pkgs/python/[email protected]/src/test_typing_extensions.py:1700 
            Path(tempdir, "ann_module3.py").write_text(ANN_MODULE_3_SOURCE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6248d9b8107864a — Filesystem access.
pkgs/python/[email protected]/src/test_typing_extensions.py:8783 
            Path(tempdir, "inspect_stock_annotations.py").write_text(STOCK_ANNOTATIONS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #195b0cdfcce06f2f — Filesystem access.
pkgs/python/[email protected]/src/test_typing_extensions.py:8784 
            Path(tempdir, "inspect_stringized_annotations.py").write_text(STRINGIZED_ANNOTATIONS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17265b26f9d5905a — Filesystem access.
pkgs/python/[email protected]/src/test_typing_extensions.py:8785 
            Path(tempdir, "inspect_stringized_annotations_2.py").write_text(STRINGIZED_ANNOTATIONS_2)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f80645d31311f94 — Filesystem access.
pkgs/python/[email protected]/src/test_typing_extensions.py:9234 
            Path(tempdir, "inspect_stringized_annotations_pep_695.py").write_text(STRINGIZED_ANNOTATIONS_PEP_695)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

uvicorn

python dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #30d0471952508d5b — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:351 
        if workers is None and "WEB_CONCURRENCY" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #211fbc54874a6b35 — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:352 
            self.workers = int(os.environ["WEB_CONCURRENCY"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fe2b58f0186745a — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:356 
            self.forwarded_allow_ips = os.environ.get("FORWARDED_ALLOW_IPS", "127.0.0.1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #889a5b7c5cb30b2d — Filesystem access.
pkgs/python/[email protected]/uvicorn/config.py:393 
                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfc98ef79d9e9527 — Filesystem access.
pkgs/python/[email protected]/uvicorn/config.py:404 
                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

vega-datasets

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #1bf1cd5178405e6e — Filesystem access.
pkgs/python/[email protected]/setup.py:13 
    with io.open(path, encoding=encoding) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #efa8c8bfa678987b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/vega_datasets/core.py:212 
            return urlopen(self.url).read()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7b0632cc3c334899 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/vega_datasets/utils.py:11 
        urlopen(Dataset.base_url, timeout=1)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

websockets

python dependency
expand_more 24 low-confidence finding(s)
low env_fs dependency Excluded from app score #84c976477717c7c5 — Filesystem access.
pkgs/python/[email protected]/setup.py:10 
exec((root_dir / "src" / "websockets" / "version.py").read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5048a13a2c5db0ab — Filesystem access.
pkgs/python/[email protected]/setup.py:16 
    (root_dir / "README.rst").read_text(encoding="utf-8"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2b2e1988094389d — Environment-variable access.
pkgs/python/[email protected]/setup.py:22 
if os.environ.get("BUILD_EXTENSION") == "no":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a979be1e925a8a43 — Environment-variable access.
pkgs/python/[email protected]/setup.py:29 
            optional=os.environ.get("BUILD_EXTENSION") != "yes",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eed84bc60f1a9e5a — Environment-variable access.
pkgs/python/[email protected]/src/websockets/asyncio/client.py:39 
MAX_REDIRECTS = int(os.environ.get("WEBSOCKETS_MAX_REDIRECTS", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ced8b4f85cc6631c — Environment-variable access.
pkgs/python/[email protected]/src/websockets/client.py:353 
BACKOFF_INITIAL_DELAY = float(os.environ.get("WEBSOCKETS_BACKOFF_INITIAL_DELAY", "5"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #986112b4777c423e — Environment-variable access.
pkgs/python/[email protected]/src/websockets/client.py:354 
BACKOFF_MIN_DELAY = float(os.environ.get("WEBSOCKETS_BACKOFF_MIN_DELAY", "3.1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2992be622cb927dd — Environment-variable access.
pkgs/python/[email protected]/src/websockets/client.py:355 
BACKOFF_MAX_DELAY = float(os.environ.get("WEBSOCKETS_BACKOFF_MAX_DELAY", "90.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f2e5b55a769dc27 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/client.py:356 
BACKOFF_FACTOR = float(os.environ.get("WEBSOCKETS_BACKOFF_FACTOR", "1.618"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #264985efb9091dc2 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/frames.py:148 
    MAX_LOG_SIZE = int(os.environ.get("WEBSOCKETS_MAX_LOG_SIZE", "75"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3408a83bdd65a3dd — Environment-variable access.
pkgs/python/[email protected]/src/websockets/http11.py:27 
USER_AGENT = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e21a49b942a3158 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/http11.py:27 
USER_AGENT = os.environ.get(
    "WEBSOCKETS_USER_AGENT",
    f"Python/{PYTHON_VERSION} websockets/{websockets_version}",
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f41b8d5ade245456 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/http11.py:33 
SERVER = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ef60d877bcd754a — Environment-variable access.
pkgs/python/[email protected]/src/websockets/http11.py:33 
SERVER = os.environ.get(
    "WEBSOCKETS_SERVER",
    f"Python/{PYTHON_VERSION} websockets/{websockets_version}",
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cd1b9d726ed8597 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/http11.py:39 
MAX_NUM_HEADERS = int(os.environ.get("WEBSOCKETS_MAX_NUM_HEADERS", "128"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14235ee5da4da5cc — Environment-variable access.
pkgs/python/[email protected]/src/websockets/http11.py:43 
MAX_LINE_LENGTH = int(os.environ.get("WEBSOCKETS_MAX_LINE_LENGTH", "8192"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb0dcb762d355db8 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/http11.py:47 
MAX_BODY_SIZE = int(os.environ.get("WEBSOCKETS_MAX_BODY_SIZE", "1_048_576"))  # 1 MiB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18ea0cf9bfb47a14 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/legacy/client.py:417 
    MAX_REDIRECTS_ALLOWED = int(os.environ.get("WEBSOCKETS_MAX_REDIRECTS", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0a2d51095f50775 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/legacy/client.py:602 
    BACKOFF_INITIAL = float(os.environ.get("WEBSOCKETS_BACKOFF_INITIAL_DELAY", "5"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6ebb4d77bdb3bfd — Environment-variable access.
pkgs/python/[email protected]/src/websockets/legacy/client.py:603 
    BACKOFF_MIN = float(os.environ.get("WEBSOCKETS_BACKOFF_MIN_DELAY", "3.1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f838dc99354ceeb1 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/legacy/client.py:604 
    BACKOFF_MAX = float(os.environ.get("WEBSOCKETS_BACKOFF_MAX_DELAY", "90.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b876b4d007249de7 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/legacy/client.py:605 
    BACKOFF_FACTOR = float(os.environ.get("WEBSOCKETS_BACKOFF_FACTOR", "1.618"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa54141e42b4b684 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/legacy/http.py:13 
MAX_NUM_HEADERS = int(os.environ.get("WEBSOCKETS_MAX_NUM_HEADERS", "128"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af7ad315cd5ae2d2 — Environment-variable access.
pkgs/python/[email protected]/src/websockets/legacy/http.py:14 
MAX_LINE_LENGTH = int(os.environ.get("WEBSOCKETS_MAX_LINE_LENGTH", "8192"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

yfinance

python dependency
expand_more 14 low-confidence finding(s)
low env_fs dependency Excluded from app score #2b5f18f2bfd963b6 — Filesystem access.
pkgs/python/[email protected]/setup.py:16 
with open("yfinance/version.py") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56d5b6e072fbec64 — Filesystem access.
pkgs/python/[email protected]/setup.py:25 
with io.open(path.join(here, 'README.md'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7af52670dcf4c0a2 — Environment-variable access.
pkgs/python/[email protected]/yfinance/_http.py:19 
_DISABLE = os.environ.get("YF_DISABLE_CURL_CFFI", "").lower() in ("1", "true", "yes")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #1adef484d90d9697 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:274 
            crumb_response = self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c39155cf7d44a00b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:276 
            crumb_response = self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c0830c66a956e507 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:313 
                response = self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #29f42f031f13a407 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:315 
                response = self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9a569a05f8805b4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:352 
                self._session.post(**post_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #953f61325923d009 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:353 
                self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b57fe926e6dde1bc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:355 
                self._session.post(**post_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #288ea2be968fa7c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:356 
                self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #285e5e2e6f5f1874 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:381 
            r = self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aa1d1613b01f9a75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:383 
            r = self._session.get(**get_args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #12edf7aeb89c0afc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/yfinance/data.py:588 
        response = self._session.post(
            action, data=data, headers=headers, timeout=timeout, allow_redirects=True
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

Skipped dependencies

Production

  • @streamlit/connection prod — registry 404
  • @streamlit/lib prod — registry 404
  • @streamlit/protobuf prod — registry 404
  • @streamlit/utils prod — registry 404
  • @types/react-helmet-async prod — no javascript source
  • typed-signals prod — dist-only: no readable source
  • react-select prod — dist-only: no readable source
  • pillow prod — sdist exceeds byte cap