Close Open Privacy Scan

link https://github.com/QwenLM/qwen-code
bolt Snapshot: commit 9dd8389
science engine v1.4
schedule 2026-07-14T00:22:17.532028+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy MCP server detected: @anthropic-ai/sdk, @modelcontextprotocol/sdk, openai — detected in dependencies, not a safety judgment.

App Privacy Score

97 /100
Low privacy risk

Low risk · 54 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 54 low
First-party packages: 2
Dependency packages: 5
Ecosystem: java

swap_horiz External domains

0:0:0:0:0:0:0:00:0:0:0:0:ffff:7f00:11.1.1.110.0.0.110.0.0.510.255.255.255100.100.100.200100.64.1.1127.0.0.1.evil.com169.254.169.254172.16.0.1172.16.0.5172.31.255.255192.0.2.1192.0.32.1192.168.0.100192.168.1.1192.168.1.5192.88.99.12001::ffff:ffff:ffff:5601:56012001::ffff:ffff:ffff:561:5612001:db8::12002:a9fe:a9fe::64:ff9b:1::127.0.0.164:ff9b::10.0.0.1::::192.168.1.1::a9fe:a9fe::ffff:0:a00:1::ffff:0:a9fe:a9fe::ffff:127.0.0.1::ffff:169.254.169.254aa.ba.b.alibaba-inc.coma.exampleabc.comabc123.atlassian.netaccounts.feishu.cnaccounts.larksuite.comagent.exampleai.google.devaiplatformaiplatform.googleapis.comaistudio.google.comalibaba-inc.comalibaba-inc.com.evil.comalice.contoso.comaliyun-inc.comaliyun-inc.com.evil.comanthropic.exampleany.comapiapi-a.exampleapi-b.exampleapi-docs.deepseek.comapi-inference.modelscope.cnapi-one.exampleapi-two.exampleapi.anthropic.comapi.anthropic.com.evil.comapi.deepseek.comapi.deepseek.com.evil.comapi.deepseek.comevil.comapi.different.comapi.dingtalk.comapi.exampleapi.first.exampleapi.github.comapi.githubcopilot.comapi.minimax.ioapi.minimaxi.comapi.mistral.aiapi.mistral.ai.evil.exampleapi.modelscope.cnapi.openai.comapi.openai.com.malicious.comapi.openai.exampleapi.openrouter.aiapi.other.comapi.second.exampleapi.sgroup.qq.comapi.telegram.orgapi.xapi.x.comapi.xiaomimimo.comapi.xiaomimimo.com.evil.exampleapi.yapi.z.aiargvasr.exampleassets.anthropic.comattackerattacker.comattacker.exampleauth.exampleautopush-generativelanguage.sandbox.googleapis.comazure.examplebb.examplebailian.console.aliyun.combkt.e.aliyuncs.combkt.oss-cn-hangzhou.aliyuncs.combots.qq.combrokenbroken.exampleccdncdn.jsdelivr.netcdn.pixabay.comcdnjs.cloudflare.comchat.qwen.aiclaudemarketplaces.comcloud.google.comcn-hongkong.dashscope.aliyuncs.comcode.visualstudio.comcodeassist.google.comcodeload.github.comcoding-intl.dashscope-intl.aliyuncs.comcoding-intl.dashscope.aliyuncs.comcoding.dashscope.aliyuncs.comcollectorcontacts.contoso.comcsp.sourcecurrent.examplecustom-api.comcustom-endpoint.comcustom-gateway.minimax.iocustom.api.comcustom.api.minimax.iocustom.comcustom.otel.collectorcustom.registry.comdaemondashboard.contoso.comdashscope-intl.aliyuncs.comdashscope-us.aliyuncs.comdashscope.aliyuncs.comdashscope.aliyuncs.com.malicious.comdashscope.exampledefault-collectordefault.env.comdevelopers.google.comdiscovered.auth.comdocs.anthropic.comdocs.expo.devdocs.fireworks.aidocs.requesty.aidocs.z.aidummy.comeemscripten.orgen.wikipedia.orgenvenv-daemoneu.api.anthropic.comevilevil.comevil.exampleexamplefc00::1fc::1fd12::1fe80::1fea0::1febf::1febf::fffirst.examplefonts.googleapis.comfonts.gstatic.comgateway.alibaba-inc.comgateway.minimaxi.comgateway.qq.comgemini-api-demos.uc.r.appspot.comgemini.env.comgeminicli.comgenerativelanguage.googleapis.comghe.internalgithub.comgithub.com.attacker.comgithub.com.evilgitlab.comgitlab.company.comgoo.glegoogle.comgoogleapis.comgrafana.examplegrafana.internalhhanging.examplehelp.aliyun.comhelp.openai.comhookshosthost.comhost.docker.internaliamcredentials.googleapis.comiconscout.comidealab.alibaba-inc.comidealab.exampleidp.exampleilinkai.weixin.qq.comimg.pnginternal-proxy.corpinternal.bug-tracker.cominvalid-proxyjigsaw.w3.orgjson-schema.orglocalhost.evil.comlogback.qos.chlogsluci.appmanager-endpoint.commarketplace.visualstudio.commcp.alibaba-inc.commcp.clickhouse.cloudmermaid-js.github.iomermaid.js.orgmermaidjs.github.iometadatametadata.google.internalmetadata.localmetricsmetrics-hostmetrics-settingsminimax.iominimaxi.commirror.internalmodel-gateway.aliyun-inc.commodelscope.cnmodelscope.cn.evil.examplemodelstudio.console.alibabacloud.commy-collector.commy-iap-service.run.appmy-malicious-site.examplemy-proxy.minimaxi.commy-repo.commy-secret-proxymycoolproxy.whatever.comnew-endpoint.comnew-resource-url.comnews.google.comnot-token-plan.cn-beijing.maas.aliyuncs.comnotalibaba-inc.comnotaliyun-inc.comnotdashscope.aliyuncs.comnovac2c.cdn.weixin.qq.comnpm.imoapi.dingtalk.comoauth.qwen.comobjects.githubusercontent.comoncall.contoso.comone.exampleontheline.trincoll.eduopen.bigmodel.cnopen.feishu.cnopen.larksuite.comopenrouter.aiotelotel-tracesother-proxy.comother.comother.exampleotlp.example.com.evil.netp2parent.complatform.claude.complatform.minimaxi.complatform.openai.complay.googleapis.compolicies.google.compre4-chat.qwen.aiprivate.ipprocess.exampleprovider-a.exampleprovider-b.exampleproxy.exampleproxy.internalproxy.localproxy.otherproxy.parentproxy.routify.aipublic.ipqwen-code-assets.oss-cn-hangzhou.aliyuncs.comqwen-tracesqwenlm.github.ioraw.githubusercontent.comreact.devrefreshed-endpoint.comrefreshed-stream-endpoint.comregistry.npmjs.orgregistry.npmmirror.comrepo.contoso.comrouter.requesty.airuntime-proxy.localsafe.comsandbox.api.sgroup.qq.comsecond.examplesecret-proxysettingssettings-proxysettings.comsindresorhus.comsomesome-oauth-issued-endpoint.examplesome.gitstale.examplestorage.googleapis.comstream-endpoint.comsub.luci.appswagger.contoso.comt.metelegram.metemp-endpoint.comtest-endpoint.comtest-servertest-server.comtest.comtest.googleapis.comtest.proxy.comtests.contoso.comtoken-plan-cn.xiaomimimo.comtoken-plan.cn-beijing.maas.aliyuncs.comtoken-plan.cn-beijing.maas.aliyuncs.com.evil.comtoken.urltracestraces-collectortraces-hosttraces-settingstwo.exampleunpkg.comupload.wikimedia.orgus.api.deepseek.comus.i.posthog.comuser-proxy.examplevia.placeholder.comwebviewwiki.contoso.comworkspace-proxy.examplewww.alibabacloud.comwww.aliyun.comwww.allrecipes.comwww.contoso.comwww.foodnetwork.comwww.googleapis.comwww.minimax.iowww.modelscope.cnwww.slf4j.orgwww.typescriptlang.orgwww.w3.orgwww.youtube.comxx.comxn--googl-fsa.comyour-proxy.comyour-server.com

</> First-Party Code

first-party (java): packages/sdk-java/client

java first-party
expand_more 2 low-confidence finding(s)
low env_fs production #67feea4bf8064367 — Environment-variable access.
repo/packages/sdk-java/client/src/main/java/com/alibaba/acp/sdk/protocol/client/request/NewSessionRequest.java:24 
        private String cwd = System.getProperty("user.dir");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3be8c33778291b1d — Filesystem access.
repo/packages/sdk-java/client/src/main/java/com/alibaba/acp/sdk/session/event/consumer/FileEventSimpleConsumer.java:58 
            try (BufferedReader br = new BufferedReader(new InputStreamReader(Files.newInputStream(file.toPath()), charset), 16384)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (java): packages/sdk-java/qwencode

java first-party
expand_more 1 low-confidence finding(s)
low env_fs production #653b33c023575179 — Environment-variable access.
repo/packages/sdk-java/qwencode/src/main/java/com/alibaba/qwen/code/cli/transport/process/TransportOptionsAdapter.java:140 
        Map<String, String> env = new HashMap<>(System.getenv());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

ch.qos.logback:logback-classic

java dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #c2307006c73c6455 — Environment-variable access.
pkgs/java/[email protected]/ch/qos/logback/classic/pattern/PropertyConverter.java:47 
                return System.getProperty(key);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

com.alibaba.fastjson2:fastjson2

java dependency
expand_more 23 low-confidence finding(s)
low env_fs dependency Excluded from app score #a3547e2e25e6fee5 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/JSONFactory.java:165 
            String property = System.getProperty("fastjson2.creator");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #515eb5d469e2004d — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/JSONFactory.java:185 
            String features = System.getProperty("fastjson2.features");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fecd3fabed99a9e — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/JSONFactory.java:230 
        String property = System.getProperty(name);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81a0636813bd930b — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/JSONFactory.java:256 
        String property = System.getProperty(name);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38d609681350cfb5 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/reader/ObjectReaderProvider.java:90 
            String property = System.getProperty(PROPERTY_DENY_PROPERTY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4014b4cabf6e1d4 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/reader/ObjectReaderProvider.java:102 
            String property = System.getProperty(PROPERTY_AUTO_TYPE_ACCEPT);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b26af0aec3901d94 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/reader/ObjectReaderProvider.java:114 
            String property = System.getProperty(PROPERTY_AUTO_TYPE_BEFORE_HANDLER);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72a7e24c4ece3486 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/reader/ObjectReaderProvider.java:137 
            String property = System.getProperty(PROPERTY_AUTO_TYPE_HANDLER);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d030793c9d400a06 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/reader/ObjectReaderProvider.java:160 
            String property = System.getProperty("fastjson.parser.safeMode");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57bd6a5cc8aa27a8 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/reader/ObjectReaderProvider.java:166 
                property = System.getProperty("fastjson2.parser.safeMode");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16e96c7d81eb440e — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/stream/JSONStreamReader.java:26 
        return of(Files.newInputStream(file.toPath()), StandardCharsets.UTF_8);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ad02873fcd29b64 — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:86 
        return new CSVReaderUTF8(Files.newInputStream(file.toPath()), StandardCharsets.UTF_8, types);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6daa43e35169c3e1 — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:100 
        return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, consumer);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #850108f3a3d43c0c — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:108 
        return new CSVReaderUTF16(new InputStreamReader(Files.newInputStream(file.toPath()), charset), consumer);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec20442fba2abf92 — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:118 
                    new InputStreamReader(Files.newInputStream(file.toPath()), charset), types

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94de2a300a6f07ca — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:122 
        return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, types);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #848e0fcd163d888f — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:136 
                            Files.newInputStream(file.toPath()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f35b3fae300b4e4a — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:143 
        return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, objectClass);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44a0b6f6164b042b — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/support/csv/CSVReader.java:430 
        try (FileInputStream in = new FileInputStream(file)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #870f28851c4eac0c — Filesystem access.
pkgs/java/[email protected]/com/alibaba/fastjson2/util/IOUtils.java:931 
        try (FileInputStream in = new FileInputStream(file)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35a8bca190ef8f76 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/util/JDKUtils.java:92 
            String jmvName = System.getProperty("java.vm.name");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31beb7bd60cfa114 — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/util/JDKUtils.java:95 
            graal = System.getProperty("org.graalvm.nativeimage.imagecode") != null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dff7e36f43da3dfb — Environment-variable access.
pkgs/java/[email protected]/com/alibaba/fastjson2/util/JDKUtils.java:100 
            String javaSpecVer = System.getProperty("java.specification.version");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

commons-io:commons-io

java dependency
expand_more 19 low-confidence finding(s)
low env_fs dependency Excluded from app score #4c1f768f708ac362 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/io/FileSystem.java:317 
            return System.getProperty(property);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41a8160e4a08859c — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:371 
        try (InputStream inputStream = new CheckedInputStream(Files.newInputStream(file.toPath()), checksum)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1704109e3cc7263f — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:501 
        try (Reader input1 = new InputStreamReader(Files.newInputStream(file1.toPath()), charset);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7329b3d3894556c8 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:502 
                Reader input2 = new InputStreamReader(Files.newInputStream(file2.toPath()), charset)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f97684c59ed7e691 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:927 
        try (InputStream fis = Files.newInputStream(input.toPath())) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41b9beab40d2b224 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:1564 
        return System.getProperty("java.io.tmpdir");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e83d90d3973b95cf — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:1584 
        return System.getProperty("user.home");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc5629167d021eae — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:2290 
            inputStream = Files.newInputStream(file.toPath());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #391817b2051153d7 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:2677 
        return new FileInputStream(file);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #190fc149f93f8cb8 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:2754 
        return Files.readAllBytes(file.toPath());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c0ba8c3291d635e — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:2787 
        return IOUtils.toString(() -> Files.newInputStream(file.toPath()), Charsets.toCharset(charsetName));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d5ea176f74d8b1b — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/FileUtils.java:2836 
        return Files.readAllLines(file.toPath(), Charsets.toCharset(charset));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23a9a36adf417062 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/file/PathUtils.java:863 
            try (InputStream inputStream1 = Files.newInputStream(nPath1, openOptions);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b674a71ff0e68ac3 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/file/PathUtils.java:864 
                    InputStream inputStream2 = Files.newInputStream(nPath2, openOptions)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f108899ec32f40e — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/io/file/PathUtils.java:1108 
        final String property = key != null && !key.isEmpty() ? System.getProperty(key, defaultPath) : defaultPath;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec8bc6ae50e1db95 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/file/PathUtils.java:1535 
        return new String(Files.readAllBytes(path), Charsets.toCharset(charset));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6dbdc4c4d8ffc60d — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/file/PathUtils.java:2005 
        Files.write(path, String.valueOf(charSequence).getBytes(Charsets.toCharset(charset)), openOptions);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5606050c1826a2ef — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/input/XmlStreamReader.java:627 
        this(Files.newInputStream(Objects.requireNonNull(file, "file")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c0a24dd371c89a3 — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/io/output/DeferredFileOutputStream.java:472 
        return Files.newInputStream(outputPath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

org.apache.commons:commons-lang3

java dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #0c4f4a1b921e3f2b — Filesystem access.
pkgs/java/[email protected]/org/apache/commons/lang3/RuntimeEnvironment.java:120 
            final byte[] bytes = Files.readAllBytes(Paths.get(envVarFile));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #148800e675207fd1 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/lang3/SystemProperties.java:3913 
            return StringUtils.getIfEmpty(System.getProperty(property), defaultIfAbsent);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57811d5e968b0231 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/lang3/SystemUtils.java:2111 
            final String value = System.getenv(name);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9366770732feb7b2 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/lang3/SystemUtils.java:2131 
        return IS_OS_WINDOWS ? System.getenv("COMPUTERNAME") : System.getenv("HOSTNAME");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

org.slf4j:slf4j-api

java dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #5b6ab1d5d05bb72f — Environment-variable access.
pkgs/java/[email protected]/org/slf4j/LoggerFactory.java:234 
        String explicitlySpecified = System.getProperty(PROVIDER_PROPERTY_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fee23180aa2dc342 — Environment-variable access.
pkgs/java/[email protected]/org/slf4j/helpers/Reporter.java:73 
        String reportStreamStr = System.getProperty(SLF4J_INTERNAL_REPORT_STREAM_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f595be16ef22bad3 — Environment-variable access.
pkgs/java/[email protected]/org/slf4j/helpers/Reporter.java:88 
        String verbosityStr = System.getProperty(SLF4J_INTERNAL_VERBOSITY_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0035bb025b0cae10 — Environment-variable access.
pkgs/java/[email protected]/org/slf4j/helpers/Util.java:44 
            result = System.getProperty(key);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @qwen-code/sdk prod — dist-only: no readable source
  • @qwen-code/channel-base prod — dist-only: no readable source
  • @qwen-code/channel-dingtalk prod — registry 404
  • @qwen-code/channel-wecom prod — registry 404
  • @qwen-code/channel-qqbot prod — registry 404
  • @qwen-code/channel-feishu prod — registry 404
  • @qwen-code/channel-telegram prod — registry 404
  • @qwen-code/channel-weixin prod — registry 404
  • @qwen-code/web-templates prod — registry 404
  • @codemirror/autocomplete prod — dist-only: no readable source
  • @codemirror/commands prod — dist-only: no readable source
  • @codemirror/language prod — dist-only: no readable source
  • @codemirror/merge prod — dist-only: no readable source
  • @codemirror/state prod — dist-only: no readable source
  • @codemirror/view prod — dist-only: no readable source
  • telegram-markdown-formatter prod — dist-only: no readable source
  • @tencent-connect/qqbot-connector prod — dist-only: no readable source