Close Open Privacy Scan

link https://github.com/dmlc/xgboost
bolt Snapshot: commit 1cc705f
science engine v1.5
schedule 2026-07-16T10:06:17.494539+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

Incomplete scan — only 3/11 dependencies were analyzed. Treat the score as provisional.

App Privacy Score

97 /100
Low privacy risk

Low risk · 14 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 14 low
First-party packages: 2
Dependency packages: 2
Ecosystem: java

swap_horiz External domains

commons.apache.org

</> First-Party Code

first-party (java): jvm-packages/xgboost4j

java first-party
expand_more 3 low-confidence finding(s)
low env_fs production #84c65b51763c27b2 — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:63 
      String os = System.getProperty("os.name", "generic").toLowerCase(Locale.ENGLISH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #323d59d5aaeb884b — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:101 
      String arch = System.getProperty("os.arch", "generic").toLowerCase(Locale.ENGLISH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eb268175234b17b6 — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:135 
      String libraryPath = System.getProperty(getPropertyNameForLibrary(libName));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (java): jvm-packages/xgboost4j-example

java first-party
expand_more 2 low-confidence finding(s)
low env_fs test-only #561c2079de3748e5 — Filesystem access.
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:48 
    FileInputStream in = new FileInputStream(f);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only #9a982e1278e62400 — Filesystem access.
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:91 
    FileInputStream in = new FileInputStream(f);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

com.esotericsoftware:kryo

java dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #4a8eafae5eeaad33 — Environment-variable access.
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:38 
	public static final boolean isAndroid = "Dalvik".equals(System.getProperty("java.vm.name"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0185464d454d90f — Environment-variable access.
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:44 
		if ("false".equals(System.getProperty("kryo.unsafe"))) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

commons-logging:commons-logging

java dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #285c9a546f324a2d — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1016 
        return AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty(key, def));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b33ce37fd8686a20 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1193 
            logDiagnostic("[ENV] Extension directories (java.ext.dir): " + System.getProperty("java.ext.dir"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #025b636697fefbea — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1194 
            logDiagnostic("[ENV] Application classpath (java.class.path): " + System.getProperty("java.class.path"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08dd700282238d98 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:88 
            name = System.getProperty("org.apache.commons.logging.log");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #689ffbb941083205 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:90 
                name = System.getProperty("org.apache.commons.logging.Log");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04431335f26d1f70 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/impl/LogFactoryImpl.java:211 
        return AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty(key, def));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a4073670c5c8e33 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/impl/SimpleLog.java:216 
            prop = System.getProperty(name);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • org.scala-lang:scala-compiler prod — no sources jar (404)
  • org.scala-lang.modules:scala-collection-compat_${scala.binary.version} prod — no sources jar (404)
  • org.scala-lang:scala-library prod — no sources jar (404)
  • org.apache.hadoop:hadoop-common prod — no sources jar (404)
  • ml.dmlc:xgboost4j-spark_2.12 prod — no sources jar (404)
  • ml.dmlc:xgboost4j-flink_2.12 prod — no sources jar (404)
  • ml.dmlc:xgboost4j_2.12 prod — no sources jar (404)
  • org.apache.flink:flink-clients prod — no sources jar (404)