Close Open Privacy Scan

bolt Snapshot: commit 298b682
science engine v1.23
schedule 2026-07-27T04:19:10.862943+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

smart_toy AI deps detected: haystack-ai, instructor, langchain, langchain-core +4 more — detected in dependencies, not a safety judgment.

App Privacy Score

57 /100
Medium privacy risk

Medium risk · 4499 finding(s)

Based on: 2 first-party package(s) · 47/54 deps analyzed

Dependency score: 0 (High risk)

bar_chart Score Breakdown

telemetry −25
egress −15
env_fs −3

list Scan Summary

0 high 191 medium 4308 low
First-party packages: 2
Dependency packages: 43
Ecosystem: python

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (6)
medium r2r dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/python/[email protected]/core/main/app_entry.py:105
  2. 2sinkpkgs/python/[email protected]/core/main/app_entry.py:104
medium r2r dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/python/[email protected]/core/providers/auth/clerk.py:65
  2. 2sinkpkgs/python/[email protected]/core/providers/auth/clerk.py:100
medium r2r dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/python/[email protected]/core/providers/auth/jwt.py:65
  2. 2sinkpkgs/python/[email protected]/core/providers/auth/jwt.py:87
medium mlflow dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
  1. 1sourcepkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:171
  2. 2sinkpkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:176
medium mlflow dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
  1. 1sourcepkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:198
  2. 2sinkpkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:203
medium transformers dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512
  2. 2sinkpkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514

</> First-Party Code

first-party (python)

python first-party
medium telemetry production #90f9c772a5a1c795 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/base.py:305
        track(
            EmbeddingUsageEvent(
                provider="langchain",
                model=getattr(self.embeddings, "model", None),
                embedding_type="legacy",
                num_requests=1,
                is_async=False,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #a461d0a0fe39c96a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/base.py:323
        track(
            EmbeddingUsageEvent(
                provider="langchain",
                model=getattr(self.embeddings, "model", None),
                embedding_type="legacy",
                num_requests=len(texts),
                is_async=False,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #128bc8a3dc2d6e67 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/base.py:341
        track(
            EmbeddingUsageEvent(
                provider="langchain",
                model=getattr(self.embeddings, "model", None),
                embedding_type="legacy",
                num_requests=1,
                is_async=True,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #089c784fb9ef02fa capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/base.py:359
        track(
            EmbeddingUsageEvent(
                provider="langchain",
                model=getattr(self.embeddings, "model", None),
                embedding_type="legacy",
                num_requests=len(texts),
                is_async=True,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #1d49c751687dbc90 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/base.py:745
        track(
            EmbeddingUsageEvent(
                provider="openai",
                model=model_name,
                embedding_type="factory_legacy",
                num_requests=1,
                is_async=False,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #6a4a2cb41bee625f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/base.py:764
    track(
        EmbeddingUsageEvent(
            provider=provider,
            model=model,
            embedding_type="factory_modern",
            num_requests=1,
            is_async=False,
        )
    )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #9aa9a5fb03a883bf capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/openai_provider.py:46
        track(
            EmbeddingUsageEvent(
                provider="openai",
                model=self.model,
                embedding_type="modern",
                num_requests=1,
                is_async=self.is_async,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #b2fe1b49912934dc capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/openai_provider.py:70
        track(
            EmbeddingUsageEvent(
                provider="openai",
                model=self.model,
                embedding_type="modern",
                num_requests=1,
                is_async=True,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #3b04f6b90c4c3512 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/openai_provider.py:97
        track(
            EmbeddingUsageEvent(
                provider="openai",
                model=self.model,
                embedding_type="modern",
                num_requests=len(texts),
                is_async=self.is_async,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #246961766ec2833f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/embeddings/openai_provider.py:127
        track(
            EmbeddingUsageEvent(
                provider="openai",
                model=self.model,
                embedding_type="modern",
                num_requests=len(texts),
                is_async=True,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #69aa2bc3a0227e38 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/base.py:266
        track(
            LLMUsageEvent(
                provider="langchain",
                model=getattr(self.langchain_llm, "model_name", None)
                or getattr(self.langchain_llm, "model", None),
                llm_type="langchain_wrapper",
                num_requests=n,
                is_async=False,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #5e645e52255f1ec9 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/base.py:319
        track(
            LLMUsageEvent(
                provider="langchain",
                model=getattr(self.langchain_llm, "model_name", None)
                or getattr(self.langchain_llm, "model", None),
                llm_type="langchain_wrapper",
                num_requests=n,
                is_async=True,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #31ad818390a07ae8 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/base.py:738
    track(
        LLMUsageEvent(
            provider=provider,
            model=model,
            llm_type="llm_factory",
            num_requests=1,
            is_async=False,
        )
    )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #9339a192a440cf70 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/base.py:1106
        track(
            LLMUsageEvent(
                provider=self.provider,
                model=self.model,
                llm_type="instructor",
                num_requests=1,
                is_async=self.is_async,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #3a6b34ab3744a153 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/base.py:1154
        track(
            LLMUsageEvent(
                provider=self.provider,
                model=self.model,
                llm_type="instructor",
                num_requests=1,
                is_async=True,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #7482942bd893e633 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/litellm_llm.py:209
        track(
            LLMUsageEvent(
                provider=self.provider,
                model=self.model,
                llm_type="litellm",
                num_requests=1,
                is_async=self.is_async,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #5738ce8fc41eb3e3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/litellm_llm.py:254
        track(
            LLMUsageEvent(
                provider=self.provider,
                model=self.model,
                llm_type="litellm",
                num_requests=1,
                is_async=True,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #dc168c31727e6912 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/oci_genai_wrapper.py:91
        track(
            LLMUsageEvent(
                provider="oci_genai",
                model=model_id,
                llm_type="oci_wrapper",
                num_requests=1,
                is_async=False,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #e192003b4595881d capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/oci_genai_wrapper.py:223
            track(
                LLMUsageEvent(
                    provider="oci_genai",
                    model=self.model_id,
                    llm_type="oci_wrapper",
                    num_requests=n,
                    is_async=False,
                )
            )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #f3dd1888eab48764 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/llms/oci_genai_wrapper.py:279
            track(
                LLMUsageEvent(
                    provider="oci_genai",
                    model=self.model_id,
                    llm_type="oci_wrapper",
                    num_requests=n,
                    is_async=True,
                )
            )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #16b47852c9856483 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/prompt/few_shot_pydantic_prompt.py:123
        track(
            PromptUsageEvent(
                prompt_type="few_shot",
                has_examples=len(self.examples) > 0,
                num_examples=len(self.examples),
                has_response_model=True,  # FewShotPydanticPrompt always has response model
                language=self.language,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #36960599229e04b1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/prompt/pydantic_prompt.py:339
        track(
            PromptUsageEvent(
                prompt_type="pydantic",
                has_examples=len(self.examples) > 0,
                num_examples=len(self.examples),
                has_response_model=True,  # PydanticPrompt always has response model
                language=self.language,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #6df52a5c484e248e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/prompt/simple_prompt.py:110
        track(
            PromptUsageEvent(
                prompt_type="simple",
                has_examples=len(self.examples) > 0 if self.examples else False,
                num_examples=len(self.examples) if self.examples else 0,
                has_response_model=self.response_model is not None,
                language="english",  # Simple prompt doesn't have language detection
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #b39805993e36c439 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/ragas/testset/synthesizers/generate.py:615
        track(
            TestsetGenerationEvent(
                event_type="testset_generation",
                evolution_names=[
                    e.__class__.__name__.lower() for e, _ in query_distribution
                ],
                evolution_percentages=[p for _, p in query_distribution],
                num_rows=testset_size,
                language="english",
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 47 low-confidence finding(s)
low env_fs Filesystem access. 34 locations
low env_fs Environment-variable access. 10 locations
low egress production #d5204d0ca6e27e1f capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
repo/src/ragas/_analytics.py:233
    requests.post(USAGE_TRACKING_URL, json=payload, timeout=USAGE_REQUESTS_TIMEOUT_SEC)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations

first-party (python): examples

python first-party
expand_more 55 low-confidence finding(s)
low env_fs Environment-variable access. 30 locations
low env_fs Filesystem access. 12 locations
low pii_flow PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime. 12 locations
low egress test-only Excluded from app score #a5be9ff085366b92 capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/examples/ragas_examples/improve_rag/rag.py:94
            urllib.request.urlopen(uri, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

</> Dependencies

mlflow

python dependency
medium telemetry dependency Excluded from app score #081fe478a107bc90 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/agno/autolog_v2.py:51
        from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #932c75d83ac8408f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/agno/autolog_v2.py:52
        from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #49e6a46e849cb7b1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/agno/autolog_v2.py:53
        from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #09801c132aadc55a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/agno/autolog_v2.py:54
        from opentelemetry.sdk.trace.export import BatchSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e3a5b6cbc04f5213 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/autogen/chat.py:4
from opentelemetry.sdk.trace import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium pii_flow dependency Excluded from app score #96a879a9b7e749a8 A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:176 · flow /tmp/closeopen-_b852lys/pkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:171 → /tmp/closeopen-_b852lys/pkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:176
                headers=request_header,

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium pii_flow dependency Excluded from app score #98ee4edbb7da41d8 A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:203 · flow /tmp/closeopen-_b852lys/pkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:198 → /tmp/closeopen-_b852lys/pkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:203
                headers=request_header,

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium telemetry dependency Excluded from app score #3ba7cd63cc53ca87 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:8
from opentelemetry.proto.resource.v1.resource_pb2 import Resource as OTelProtoResource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5633be8e5d1ae29d capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:9
from opentelemetry.proto.trace.v1.trace_pb2 import Span as OTelProtoSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #222bb199c774ff02 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:10
from opentelemetry.proto.trace.v1.trace_pb2 import Status as OTelProtoStatus

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e60151ff32653cf3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:11
from opentelemetry.sdk.resources import Resource as _OTelResource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #38093282beabe9e5 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:12
from opentelemetry.sdk.trace import Event as OTelEvent

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #69fe48a2309d5e34 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:13
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7f0acff564161ff4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:14
from opentelemetry.trace import NonRecordingSpan, SpanContext, TraceFlags

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e867b35c0ce5d1ae capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:15
from opentelemetry.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8963087741cc660c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:16
from opentelemetry.trace import Status as OTelStatus

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7f6a359dfed0fdd7 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span.py:17
from opentelemetry.trace import StatusCode as OTelStatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f335eb0991afd8e6 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span_event.py:7
from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #24968bb2376b336a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span_event.py:76
        from opentelemetry.proto.trace.v1.trace_pb2 import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1d1b6ae2b92209ec capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span_status.py:6
from opentelemetry import trace as trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ddb872ecb757817e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/span_status.py:7
from opentelemetry.proto.trace.v1.trace_pb2 import Status as OtelStatus

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c9f05c4f4d72b8b0 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/trace_state.py:3
from opentelemetry import trace as trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a7f7af3c7990dc76 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/entities/trace_status.py:3
from opentelemetry import trace as trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #486aeee5a32eca0d capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/genai/utils/llm_utils.py:191
        token_counter.track(response)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #eeeb9c9d084b4e20 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/genai/utils/llm_utils.py:246
        token_counter.track(response)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a971e1ff136990b5 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/genai/utils/trace_utils.py:12
from opentelemetry.trace import NoOpTracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7de5e5cbaa341a25 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/haystack/autolog.py:7
from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #98d82560669428da capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/haystack/autolog.py:8
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d524dec1b69f2dd0 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/haystack/autolog.py:9
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6925e56a87b2b492 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/haystack/autolog.py:10
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8fbfd107dfc141ee capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/haystack/autolog.py:11
from opentelemetry.sdk.trace import TracerProvider as SDKTracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #99dcd8d4a8f7cb7f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/haystack/autolog.py:12
from opentelemetry.sdk.trace.export import SimpleSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cedc566ce3edf37b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/haystack/autolog.py:13
from opentelemetry.trace import (
    NoOpTracerProvider,
    ProxyTracerProvider,
    get_tracer_provider,
    set_tracer_provider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3925eb1b3369c2ee capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/keras/save.py:93
    export_archive.track(model)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #81fdd68cf3e55ae1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:19
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #92aa8d44f9352357 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:20
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5c41b0a48d75b012 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:21
from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ac902ede117c9c56 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:22
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6f90dfb958ac38f4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:23
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c970362ac532c7ee capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:24
from opentelemetry.sdk.trace import SpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d3300e527f98d104 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:25
from opentelemetry.sdk.trace import TracerProvider as SdkTracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #052510842507b569 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/otel/__init__.py:26
from opentelemetry.sdk.trace.export import BatchSpanProcessor, SimpleSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #def38ceed2b2aece capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/protos/databricks_tracing_pb2.py:25
  from opentelemetry.proto.trace.v1 import trace_pb2 as opentelemetry_dot_proto_dot_trace_dot_v1_dot_trace__pb2

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7560059f265d8a09 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/protos/databricks_tracing_pb2.py:331
  from opentelemetry.proto.trace.v1 import trace_pb2 as opentelemetry_dot_proto_dot_trace_dot_v1_dot_trace__pb2

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f91e048c6969500b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/protos/databricks_tracing_pb2.pyi:7
from opentelemetry.proto.trace.v1 import trace_pb2 as _trace_pb2

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f92f0d2f2e70907c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/protos/service_pb2.py:27
  from opentelemetry.proto.trace.v1 import trace_pb2 as opentelemetry_dot_proto_dot_trace_dot_v1_dot_trace__pb2

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #efd764586949381f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/protos/service_pb2.py:1454
  from opentelemetry.proto.trace.v1 import trace_pb2 as opentelemetry_dot_proto_dot_trace_dot_v1_dot_trace__pb2

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8a66afb082367608 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/protos/service_pb2.pyi:9
from opentelemetry.proto.trace.v1 import trace_pb2 as _trace_pb2

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #68b22b985fe7dcde capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/autolog.py:4
from opentelemetry import trace as otel_trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #28b96b3b36adba92 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/autolog.py:5
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6160e685f42dcaa0 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/autolog.py:6
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #17bbea988da5e107 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/autolog.py:7
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9e5685a3528c1be3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/autolog.py:8
from opentelemetry.sdk.trace import TracerProvider as SDKTracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f0917e8d00029c93 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/autolog.py:9
from opentelemetry.sdk.trace.export import SimpleSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dd3ff53216a546ab capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/autolog.py:10
from opentelemetry.trace import (
    NoOpTracerProvider,
    ProxyTracerProvider,
    get_tracer_provider,
    set_tracer_provider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3b380c64a4a92dd4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/tracing_utils.py:4
from opentelemetry import context as otel_context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6e526e75e99ee0e0 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/tracing_utils.py:5
from opentelemetry import trace as otel_trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7165ee0c30d98a39 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/semantic_kernel/tracing_utils.py:6
from opentelemetry.trace import get_current_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a885a40eeec06b31 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/server/otel_api.py:22
from opentelemetry.proto.collector.trace.v1.trace_service_pb2 import (
    ExportTraceServiceRequest,
    ExportTraceServiceResponse,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #96309e7a3d649fa5 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/store/tracking/databricks_rest_store.py:9
from opentelemetry.proto.collector.trace.v1.trace_service_pb2 import ExportTraceServiceRequest

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #057c9d706a8a1844 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/store/tracking/rest_store.py:12
from opentelemetry.proto.collector.trace.v1.trace_service_pb2 import ExportTraceServiceRequest

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #741f9a4538053f8e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/strands/autolog.py:5
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6ce0191d226ba8d3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/strands/autolog.py:6
from opentelemetry.sdk.trace import (
    ReadableSpan as OTelReadableSpan,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0f775f465af4ddba capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/strands/autolog.py:9
from opentelemetry.sdk.trace import (
    Span as OTelSpan,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ab838cc83da5fb50 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/strands/autolog.py:12
from opentelemetry.sdk.trace import (
    TracerProvider as SDKTracerProvider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0029172c4a7d4fc0 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/strands/autolog.py:15
from opentelemetry.sdk.trace.export import SimpleSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1f290d7ae703891d capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/strands/autolog.py:16
from opentelemetry.trace import (
    NoOpTracer,
    NoOpTracerProvider,
    ProxyTracerProvider,
    get_tracer_provider,
    set_tracer_provider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a444dd5ce5009fec capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/distributed/__init__.py:4
from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #25b48ef0fc789fea capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/export/genai_semconv/translator.py:14
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e389af483949aabe capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/export/genai_semconv/translator.py:15
from opentelemetry.trace import SpanKind

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e9a5a45a912c44bf capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/export/inference_table.py:5
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #37c32def24bd1b3c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/export/inference_table.py:6
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #128822567b06cbd4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/export/mlflow_v3.py:6
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f49ca3915c22a5af capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/export/mlflow_v3.py:7
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #af9a10ec23512b02 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/export/uc_table.py:4
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a289ee9de75de4f8 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/fluent.py:16
from opentelemetry import trace as trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2b3154bc9b479c45 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/otel/otel_archival.py:10
from opentelemetry.proto.trace.v1.trace_pb2 import TracesData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a3eb0fcde86de851 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/base_mlflow.py:7
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5ca6a8f9b6ceb8e7 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/base_mlflow.py:8
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #898e1199c7d56754 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/base_mlflow.py:9
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2da81b4d26f188ca capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/base_mlflow.py:10
from opentelemetry.sdk.trace.export import (
    BatchSpanProcessor,
    SimpleSpanProcessor,
    SpanExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #43edfed9c55ffff3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/inference_table.py:4
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f34f93e968f795b9 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/inference_table.py:5
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #07c676cbdd17d072 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/inference_table.py:6
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8548de85f1df984a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/inference_table.py:7
from opentelemetry.sdk.trace.export import SimpleSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #652a93ddb650aefb capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/mlflow_v3.py:3
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e969b879d6c32a95 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/mlflow_v3.py:4
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #df35647b2dbc6602 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel.py:3
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c6f248eabef93a30 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel.py:4
from opentelemetry.sdk.trace.export import BatchSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #14c5d60d1e3ba804 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel_metrics_mixin.py:11
from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6fbed7d18a41cb2b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel_metrics_mixin.py:12
from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e3344153eb445c3b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel_metrics_mixin.py:13
from opentelemetry.sdk.metrics.export import PeriodicExportingMetricReader

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d594dd36092b201b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel_metrics_mixin.py:14
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fedecb387b2637d3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel_metrics_mixin.py:52
            from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import (
                OTLPMetricExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #acfe0079fef346c4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/otel_metrics_mixin.py:56
            from opentelemetry.exporter.otlp.proto.http.metric_exporter import (
                OTLPMetricExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #638b7d82b78a4af5 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/uc_table.py:3
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6cda4e754da75ba1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/uc_table.py:4
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d6644ce86bf94a41 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/processor/uc_table.py:5
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4fe36bf159f8e724 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/provider.py:19
from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c41f4d3eefbda1c1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/provider.py:20
from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9ac70530222bc780 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/provider.py:21
from opentelemetry.context.contextvars_context import ContextVarsRuntimeContext

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0a5936950fe4a919 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/provider.py:22
from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #40f1b6614746d5bb capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/provider.py:23
from opentelemetry.sdk.trace import SpanProcessor, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #29d4b4b77a8c7999 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/provider.py:24
from opentelemetry.sdk.trace.id_generator import IdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #401eec773964a52b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/provider.py:25
from opentelemetry.sdk.trace.sampling import ParentBased

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #faf71083f79c7a9b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/sampling.py:3
from opentelemetry.sdk.trace.sampling import (
    Sampler,
    SamplingResult,
    TraceIdRatioBased,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #02e1cbcd41ef293a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/__init__.py:15
from opentelemetry import trace as trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4e10eadd5743b862 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/__init__.py:16
from opentelemetry.sdk.trace import ReadableSpan as OTelReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ca9bb3b5bbf834f8 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/__init__.py:17
from opentelemetry.sdk.trace import Span as OTelSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #639579dd3a63222a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/otlp.py:7
from opentelemetry.proto.common.v1.common_pb2 import AnyValue, ArrayValue, KeyValueList

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0bc06bcd9f4b7738 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/otlp.py:8
from opentelemetry.proto.resource.v1.resource_pb2 import Resource as OTelProtoResource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f6bef27beed0fb24 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/otlp.py:9
from opentelemetry.sdk.resources import Resource as OTelResource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #705de0cb23d09756 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/otlp.py:10
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #499f34d1525ffc0c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/otlp.py:62
            from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e99e7723551f8e53 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/mlflow/tracing/utils/otlp.py:73
            from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 628 low-confidence finding(s)
low env_fs Filesystem access. 263 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 28 locations
low env_fs Environment-variable access. 336 locations
low egress dependency Excluded from app score #09c673cf7aea49d3 capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/mlflow/deployments/openai/__init__.py:174
            response = requests.get(
                "https://api.openai.com/v1/models",
                headers=request_header,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

langfuse

python dependency
medium telemetry dependency Excluded from app score #a5f830cb562237e2 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:32
from opentelemetry import context as otel_context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4522405da09636b2 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:33
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a045686aa57f232e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:34
from opentelemetry.sdk.trace import ReadableSpan, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b6537fac0fe05c50 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:35
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #65243b258e1f22f1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:36
from opentelemetry.sdk.trace.id_generator import IdGenerator, RandomIdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #697cc51f327cf546 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:37
from opentelemetry.util._decorator import (
    _AgnosticContextManager,
    _agnosticcontextmanager,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b3830f9337828680 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/observe.py:22
from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f535d3d46071f64f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:23
from opentelemetry import (
    baggage,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #31ca42bdf771eba1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:26
from opentelemetry import (
    baggage as otel_baggage_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #25b1b85822586eb3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:29
from opentelemetry import (
    context as otel_context_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d49180d91268e7d4 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:32
from opentelemetry import (
    trace as otel_trace_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f8b656e1cd6e3102 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:35
from opentelemetry.context import _RUNTIME_CONTEXT

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ba286d317a477c07 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:36
from opentelemetry.util._decorator import (
    _AgnosticContextManager,
    _agnosticcontextmanager,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f72c92355ef83089 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:27
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1a694eb6816b7789 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:28
from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8695543ac713312e capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:29
from opentelemetry.sdk.trace import ReadableSpan, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a173d5660f7e8f71 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:30
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5e8fdf206b908672 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:31
from opentelemetry.sdk.trace.id_generator import IdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #81c85aace914d6a1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:32
from opentelemetry.sdk.trace.sampling import Decision, TraceIdRatioBased

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #949d31702570d4a6 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:33
from opentelemetry.trace import Tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dbb3bd722da3b5f3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span.py:30
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #16cc87abdc723c46 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span.py:31
from opentelemetry.trace.status import Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5a7d6476a09fd19c capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span.py:32
from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0feca2ca5c54db72 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:7
from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #079211283df072a5 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:8
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #39c6df60d48858d7 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:9
from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3c3fbd130fe57ccb capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:10
from opentelemetry.sdk.util import BoundedList

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #844a55f1c0892764 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:11
from opentelemetry.trace import format_span_id, format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #78f00c7782f16ae3 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:12
from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c866c730e171747a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_filter.py:7
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a6b6c8ea69767a6a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:19
from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9aec168e6dd8005d capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:20
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6774bebfa96f7728 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:21
from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #45ea5331e2bf3e8a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:22
from opentelemetry.sdk.trace import ReadableSpan, Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f3ee88c6b796fd0b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:23
from opentelemetry.sdk.trace.export import BatchSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #81e12ca0a285b0ad capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:24
from opentelemetry.trace import format_span_id, format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9cabbd160f62959a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/utils.py:14
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e17f8c3f88800e94 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/utils.py:15
from opentelemetry.sdk import util

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #db2cb701a56959bf capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/utils.py:16
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a70d501f52050f21 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/langchain/CallbackHandler.py:19
from opentelemetry import context, trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c626830c7614f59a capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/langchain/CallbackHandler.py:20
from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #27f8888defb0a5f1 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/types.py:33
from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 62 low-confidence finding(s)
low env_fs Environment-variable access. 31 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 30 locations
low env_fs dependency Excluded from app score #0d8304d7fd498b19 capability detected · no path traced Filesystem access.
pkgs/python/[email protected]/langfuse/media.py:178
            with open(file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

r2r

python dependency
medium pii_flow dependency Excluded from app score #7fe51fdb4db38d9d PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/core/main/app_entry.py:104 · flow /tmp/closeopen-_b852lys/pkgs/python/[email protected]/core/main/app_entry.py:105 → /tmp/closeopen-_b852lys/pkgs/python/[email protected]/core/main/app_entry.py:104
logging.info(
    f"Environment R2R_POSTGRES_PASSWORD: {os.getenv('R2R_POSTGRES_PASSWORD')}"
)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #21d61fb8ba5b1b2c PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/core/providers/auth/clerk.py:100 · flow /tmp/closeopen-_b852lys/pkgs/python/[email protected]/core/providers/auth/clerk.py:65 → /tmp/closeopen-_b852lys/pkgs/python/[email protected]/core/providers/auth/clerk.py:100
                logger.debug(f"Creating new user: {payload.get('email')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4fe64730cb7869e8 PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/core/providers/auth/jwt.py:87 · flow /tmp/closeopen-_b852lys/pkgs/python/[email protected]/core/providers/auth/jwt.py:65 → /tmp/closeopen-_b852lys/pkgs/python/[email protected]/core/providers/auth/jwt.py:87
                logger.debug(f"Creating new user: {user.get('email')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium telemetry dependency Excluded from app score #6e5881d93af2c889 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/core/utils/sentry.py:4
import sentry_sdk

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ef3fab91732de609 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/core/utils/sentry.py:13
        sentry_sdk.init(
            dsn=dsn,
            environment=os.getenv("R2R_SENTRY_ENVIRONMENT", "not_set"),
            traces_sample_rate=float(
                os.getenv("R2R_SENTRY_TRACES_SAMPLE_RATE", 1.0)
            ),
            profiles_sample_rate=float(
                os.getenv("R2R_SENTRY_PROFILES_SAMPLE_RATE", 1.0)
            ),
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 156 low-confidence finding(s)
low env_fs Environment-variable access. 115 locations
low env_fs Filesystem access. 18 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 3 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 20 locations

haystack-ai

python dependency
medium telemetry dependency Excluded from app score #737973c6cc6b93c9 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/haystack/telemetry/_telemetry.py:15
import posthog

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #51d0657926edfc6f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/haystack/telemetry/_telemetry.py:111
            posthog.capture(
                distinct_id=self.user_id, event=event_name, properties={**self.event_properties, **event_properties}
            )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 52 low-confidence finding(s)
low env_fs Environment-variable access. 30 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
low env_fs Filesystem access. 19 locations

rich

python dependency
medium telemetry dependency Excluded from app score #4da275a97ddb252b capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/rich/progress.py:173
        yield from progress.track(
            sequence,
            total=total,
            completed=completed,
            description=description,
            update_period=update_period,
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 22 low-confidence finding(s)

transformers

python dependency
medium pii_flow dependency Excluded from app score #e1c32ff321a8fad7 PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514 · flow /tmp/closeopen-_b852lys/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 → /tmp/closeopen-_b852lys/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
            logger.debug(f"[Kubeflow] Token file not found: {token_path}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 399 low-confidence finding(s)
low env_fs Filesystem access. 249 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 13 locations
low env_fs Environment-variable access. 136 locations
low egress dependency Excluded from app score #cb08ff5c727e4a88 capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/transformers/utils/attention_visualizer.py:183
            img = Image.open(io.BytesIO(httpx.get(img, follow_redirects=True).content))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

typer

python dependency
medium telemetry dependency Excluded from app score #0e21e7ccabc7c18f capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/docs_src/progressbar/tutorial001_py310.py:12
    for value in track(range(100), description="Processing..."):

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 66 low-confidence finding(s)
low env_fs Filesystem access. 37 locations
low env_fs Environment-variable access. 29 locations

GitPython

python dependency
expand_more 55 low-confidence finding(s)
low env_fs Filesystem access. 32 locations
low env_fs Environment-variable access. 23 locations

appdirs

python dependency
expand_more 7 low-confidence finding(s)
low env_fs Environment-variable access. 6 locations
low env_fs dependency Excluded from app score #36f50d364decc69b capability detected · no path traced Filesystem access.
pkgs/python/[email protected]/setup.py:18
    inf = open(os.path.join(os.path.dirname(__file__), fname))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

datacompy

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #965e6c5552118474 capability detected · no path traced Filesystem access.
pkgs/python/[email protected]/datacompy/base.py:394
    html_file.write_text(html_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

datasets

python dependency
expand_more 77 low-confidence finding(s)
low env_fs Filesystem access. 52 locations
low env_fs Environment-variable access. 25 locations

google-api-python-client

python dependency
expand_more 13 low-confidence finding(s)
low env_fs Environment-variable access. 6 locations
low env_fs Filesystem access. 6 locations
low egress dependency Excluded from app score #6a7496103185a8c4 capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/googleapiclient/http.py:191
            resp, content = http.request(uri, method, *args, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

google-auth

python dependency
expand_more 81 low-confidence finding(s)
low env_fs Environment-variable access. 46 locations
low env_fs Filesystem access. 28 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 7 locations

huggingface_hub

python dependency
expand_more 185 low-confidence finding(s)
low env_fs Filesystem access. 64 locations
low env_fs Environment-variable access. 57 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 62 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 2 locations

langchain

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #6c002fec569c6a5d capability detected · no path traced Environment-variable access.
pkgs/python/[email protected]/langchain/agents/middleware/_execution.py:322
        host_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs Filesystem access. 3 locations

langchain-core

python dependency
expand_more 26 low-confidence finding(s)
low env_fs Environment-variable access. 17 locations
low env_fs Filesystem access. 8 locations
low egress dependency Excluded from app score #90e174f2d6769da0 capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/langchain_core/runnables/graph_mermaid.py:461
            response = requests.get(image_url, timeout=10, proxies=proxies)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

langchain_openai

python dependency
expand_more 21 low-confidence finding(s)
low env_fs Environment-variable access. 15 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
low env_fs Filesystem access. 3 locations

nbmake

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #ebc17391cd4ac797 capability detected · no path traced Environment-variable access.
pkgs/python/[email protected]/src/nbmake/pytest_plugin.py:79
            if os.environ.get("GITHUB_ACTIONS", False):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

networkx

python dependency
expand_more 16 low-confidence finding(s)
low env_fs Environment-variable access. 12 locations
low env_fs Filesystem access. 3 locations
low egress tooling Excluded from app score unreachable #8163156ba927e5b7 capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/graph/plot_football.py:24
sock = urllib.request.urlopen(url)  # open URL

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

nltk

python dependency
expand_more 93 low-confidence finding(s)
low env_fs Filesystem access. 67 locations
low env_fs Environment-variable access. 22 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations

numpy

python dependency
expand_more 982 low-confidence finding(s)
low env_fs Filesystem access. 618 locations
low env_fs Environment-variable access. 356 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 3 locations

oci

python dependency
expand_more 130 low-confidence finding(s)
low env_fs Filesystem access. 23 locations
low env_fs Environment-variable access. 97 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 10 locations

openai

python dependency
expand_more 69 low-confidence finding(s)
low env_fs Filesystem access. 16 locations
low env_fs Environment-variable access. 47 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 4 locations

openai-agents

python dependency
expand_more 303 low-confidence finding(s)
low env_fs Environment-variable access. 216 locations
low env_fs Filesystem access. 65 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 18 locations
low pii_flow PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime. 4 locations

pandas

python dependency
expand_more 29 low-confidence finding(s)
low env_fs Filesystem access. 12 locations
low env_fs Environment-variable access. 16 locations
low egress dependency Excluded from app score #3a8e3b7a82a9beac capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pandas/io/common.py:282
    return urllib.request.urlopen(*args, **kwargs)  # noqa: TID251

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pre-commit

python dependency
expand_more 58 low-confidence finding(s)
low env_fs Environment-variable access. 25 locations
low env_fs Filesystem access. 31 locations
low egress dependency Excluded from app score #1aec90b7cbd69e62 capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/pre_commit/languages/golang.py:92
    resp = urllib.request.urlopen('https://go.dev/dl/?mode=json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7dc993acc517d11a capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pre_commit/languages/golang.py:104
        resp = urllib.request.urlopen(_get_url(version))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pytest

python dependency
expand_more 437 low-confidence finding(s)
low env_fs Environment-variable access. 76 locations
low env_fs Filesystem access. 356 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 2 locations

pytest-xdist

python dependency
expand_more 26 low-confidence finding(s)
low env_fs Environment-variable access. 7 locations
low env_fs Filesystem access. 19 locations

rank_bm25

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #7537d321a418739e capability detected · no path traced Filesystem access.
pkgs/python/[email protected]/setup.py:12
    with io.open(os.path.join(here, 'README.md'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sentence-transformers

python dependency
expand_more 58 low-confidence finding(s)
low env_fs Environment-variable access. 7 locations
low env_fs Filesystem access. 51 locations

Skipped dependencies

Production

  • instructor prod — sdist exceeds byte cap
  • pillow prod — sdist exceeds byte cap
  • langchain-community prod — sdist exceeds byte cap
  • rapidfuzz prod — sdist exceeds byte cap
  • llama_index prod — no python source in sdist
  • dspy-ai prod — no python source in sdist
  • llama-index prod — no python source in sdist