Close Open Privacy Scan

link https://github.com/open-webui/open-webui
bolt Snapshot: commit ecd48e2
science engine v1.5
schedule 2026-07-15T00:17:30.526970+00:00

verified_user Application data leak confirmed

High-confidence data exfiltration identified in application code.

smart_toy MCP server detected: anthropic, chromadb, langchain, mcp +4 more — detected in dependencies, not a safety judgment.

App Privacy Score

0 /100
High privacy risk — application leak confirmed

High risk · 2843 finding(s)

Dependency score: 0 (High risk)

bar_chart Score Breakdown

pii_flow −60
telemetry −25
egress −15
env_fs −3

list Scan Summary

21 high 58 medium 2764 low
First-party packages: 2
Dependency packages: 52
Ecosystem: python

swap_horiz Confirmed data exfiltration in application code

External domains: 10.10.1.10169.254.169.254::ffff:192.168.0.1aa9.comabc.comabc123.atlassian.netaccount.blob.core.windows.netaccounts.feishu.cnaccounts.google.comacl2014.orgaclanthology.orgaclweb.orgacme.comai.google.devaiplatform.googleapis.comaka.msalembic.sqlalchemy.orgalice.contoso.comalpinejs.devanthology.aclweb.orgapi-inference.huggingface.coapi.anthropic.comapi.bing.microsoft.comapi.bochaai.comapi.cloudflare.comapi.deepgram.comapi.elevenlabs.ioapi.exa.aiapi.firecrawl.devapi.github.comapi.jina.aiapi.linkup.soapi.microsoft.aiapi.mistral.aiapi.mojeek.comapi.mongodb.orgapi.morphllm.comapi.open-meteo.comapi.openai.comapi.openwebui.comapi.perplexity.aiapi.python.langchain.comapi.search.brave.comapi.serphouse.comapi.serply.ioapi.tavily.comapi.themoviedb.orgapi.together.xyzapis.google.comapp.neptune.aiarrow.apache.orgarxiv.orgasktom.oracle.comattribution.omnilib.devauai.orgauth.exampleauthlib.orgaws.amazon.comazure.microsoft.combbedrock-runtimebitbucket.orgblocked.exampleblog.eleuther.aiblogs.oracle.comborel.slu.edubrotlipy.readthedocs.iobugs.python.orgcdn-media.huggingface.cocdn.britannica.comcdn.jsdelivr.netcdn.pixabay.comcdnjs.cloudflare.comchat.googleapis.comchildes.talkbank.orgchroma-onnx-models.s3.amazonaws.comchromium.googlesource.comclear.mlclip-cn-beijing.oss-cn-beijing.aliyuncs.comcloud.google.comcode.activestate.comcode.google.comcognitiveservices.azure.comcommonmark.orgconsole.cloud.google.comcontacts.contoso.comcookbook.openai.comcreativecommons.orgcvs.pgfoundry.orgcx-oracle.readthedocs.iodagshub.comdashboard.contoso.comdata.iana.orgdatabase.windows.netdatatracker.ietf.orgday.js.orgdev-discuss.pytorch.orgdev.mysql.comdev.twitter.comdeveloper.mozilla.orgdevelopers.cloudflare.comdevelopers.google.comdigital.cs.usu.edudiscord.comdiscord.ggdiscuss.huggingface.codiscuss.python.orgdiscuss.pytorch.orgdl.acm.orgdoclingdocs.aiohttp.orgdocs.anthropic.comdocs.aws.amazon.comdocs.claude.comdocs.langchain.comdocs.microsoft.comdocs.neptune.aidocs.nomic.aidocs.nvidia.comdocs.oasis-open.orgdocs.ollama.comdocs.openwebui.comdocs.parallel.aidocs.pydantic.devdocs.pyscript.netdocs.python-requests.orgdocs.python.orgdocs.pytorch.orgdocs.ray.iodocs.rsdocs.sqlalchemy.orgdocs.swanlab.cndocs.together.aidocs.trychroma.comdocs.wandb.aidoi.orgdownload.oracle.comdvc.orgembed.trychroma.comen.wikipedia.orgendpoint.openai.azure.comerrors.pydantic.devessentia.upf.eduevil.comexam_ple.comexamine.devexampleexample-resource.azure.openai.comexample-resource.services.ai.azure.comexplosion.aifakeurlfarm4.staticflickr.comfastapi.tiangolo.comfb.mefilesystem-spec.readthedocs.iofki.tic.heia-fr.chflyte.orgfonts.googleapis.comfoofoo.comframenet2.icsi.berkeley.edugateway.ai.cloudflare.comgenerativelanguage.googleapis.comgeoip.maps.opensearch.orggiou.stanford.edugist.github.comgithubgithub.comgithub.githubassets.comgitlab.comgoo.glgoogle-auth.readthedocs.iogoogle.aip.devgoogle.comgoogle.github.iogoogle.serper.devgoogleapis.devgraph.microsoft.comguillaumejaume.github.iohelp.openai.comhf.cohips.hearstapps.comhomepages.inf.ed.ac.ukhooks.slack.comhosthost.docker.internalhostnamehtml.spec.whatwg.orghttpbin.orghub-ci.huggingface.cohuggingface.cohypothesis.readthedocs.ioi.postimg.cciamcredentialsicml.cciconscout.comimages.cocodataset.orgimages.pexels.cominfer.roboflow.cominstagram.comipython.readthedocs.ioiso639-3.sil.orgjavarevisited.blogspot.comjgaa.infojigsaw.w3.orgjson-schema.orgjsonlines.orgjsonplaceholder.typicode.comkagi.comkazoo.readthedocs.iokexue.fmkombu.readthedocs.orgkorpus.plkroki.ioleafletjs.comlearn.microsoft.comlegacy.python.orglicenses.api.openwebui.comlinux.die.netlisten-api.listennotes.comlocalhost.tiangolo.comlogin.chinacloudapi.cnlogin.microsoft.comlogin.microsoftonline.comlogin.microsoftonline.delogin.microsoftonline.uslogin.windows-ppe.netlucene.apache.orglucumr.pocoo.orgm.youtube.commacvmlschemaurimagicstack.github.iomanagement.core.chinacloudapi.cnmanagement.core.usgovcloudapi.netmanagement.core.windows.netmarc.najork.orgmatplotlib.orgmedium.commermaid-js.github.iomermaid.js.orgmermaidjs.github.iomistralai.github.iomodelcontextprotocol.iomsdn.microsoft.commy-keyvault-name.vault.azure.netmy-malicious-site.examplemy.sitemyaccount.blob.core.windows.netmypy.readthedocs.iomyservice.search.windows.netmüller.denats.ionew-url.comnewsapi.orgngram.sourceforge.netnineplanets.orgnkjp.plnlp.stanford.edunodatime.orgns.adobe.comoauth.netofek.devollama-service.open-webui.svc.cluster.localollama.comomoindrot.github.ioomwn.orgoncall.contoso.comonedrive.live.comonnxruntime.aiopen.feishu.cnopenai.comopenaipublic.blob.core.windows.netopenid.netopenoffice.orgopenreview.netopensearch.orgopensource.adobe.comopentelemetry.ioopenwebui.comoptuna.readthedocs.iooracle.github.ioorc.apache.orgoss.redis.comother.comother_hostotheraccount.blob.core.windows.netpackaging.python.orgpaddle-model-ecology.bj.bcebos.compages.ucsd.edupbs.twimg.compendulum.eustace.iopenghao-bdsc.github.iopeople.csail.mit.edupeps.python.orgperldoc.perl.orgpillow.readthedocs.ioplatform.claude.complatform.openai.complg.uwaterloo.caproceedings.neurips.ccprosemirror.netproto-plus-python.readthedocs.iopublic.ukp.informatik.tu-darmstadt.depurl.oclc.orgpurl.orgpy-pdf.github.iopydantic-docs.helpmanual.iopyjwt.readthedocs.iopymysql.readthedocs.iopypdf.readthedocs.iopypi.orgpypi.python.orgpypika.readthedocs.iopyscript.github.iopython-devtools.helpmanual.iopython-etcd3.readthedocs.iopython-oracledb.readthedocs.iopython.langchain.compython.orgpythonhosted.orgpytorch.orgqianwen-res.oss-cn-beijing.aliyuncs.comqwenlm.github.ioraw.githubusercontent.comreactjs.orgredis.comredis.ioredis.readthedocs.ioredisearch.ioredux.js.orgreference.langchain.comreplit.comrepo.contoso.comrequests.readthedocs.iorestrictedpython.readthedocs.iorich.readthedocs.iorocling.iis.sinica.edu.twrrc.cvc.uab.ess.jina.ais3.amazonaws.comsafetensors-convert.hf.spacesans-io.readthedocs.iosbert.netschema.orgschemasschemas.microsoft.comschemas.openid.netschemas.openxmlformatsschemas.openxmlformats.orgschemas.zwobble.orgscikit-learn.orgsearch.azure.comsearch.cpan.orgsearchapi.api.cloud.yandex.netsentiwordnet.isti.cnr.itserpapi.comsethmlarson.devsheetjs.openxmlformats.orgsmith.langchain.comsnowball.tartarus.orgsocket.iosoundcloud.comsourceforge.netspdx.devspdx.orgspec.openapis.orgsqlalche.mesqlite.orgstackoverflow.comstanfordnlp.github.iostorage.azure.comstorage.googleapis.comstorage.mtls.googleapis.comstp.lingfil.uu.sestuk.github.iosuno-ai.notion.sitesvn.ask.it.usyd.edu.auswagger.contoso.comswagger.ioswanlab.cntadm.sf.nettartarus.orgtechnet.microsoft.comtechspot.zzzeek.orgtedlab.mit.edutests.contoso.comthumbs.dreamstime.comtikatimeapi.iotools.ietf.orgtowardsdatascience.comtvm.apache.orgtwitter.comtyper.tiangolo.comunpkg.comurl1url2urllib3.readthedocs.iovalidator.swagger.iovega.github.ioverbs.colorado.eduvladimirgorej.comweb.archive.orgweb.stanford.eduwebdocs.cs.ualberta.cawebsockets.readthedocs.iowicg.github.iowiki.contoso.comwordnet.princeton.eduwww-i6.informatik.rwth-aachen.dewww-users.york.ac.ukwww.aclweb.orgwww.ags.uni-sb.dewww.aiim.orgwww.apache.orgwww.census.govwww.cis.lmu.dewww.cis.upenn.eduwww.cl.uni-heidelberg.dewww.color.orgwww.comet.comwww.contoso.comwww.cs.cmu.eduwww.cs.cornell.eduwww.cs.jhu.eduwww.cs.uic.eduwww.cs.unm.eduwww.cs.waikato.ac.nzwww.d.umn.eduwww.datalab.towww.deepmind.comwww.deepspeed.aiwww.dvc.orgwww.emojione.comwww.example.珠宝www.facebook.comwww.freetds.orgwww.gevent.orgwww.github.comwww.google.comwww.googleapis.comwww.gravatar.comwww.grsampson.netwww.gutenberg.orgwww.iana.orgwww.ietf.orgwww.ilankelman.orgwww.iso.orgwww.itl.nist.govwww.kecl.ntt.co.jpwww.kxan.comwww.let.rug.nlwww.ling.upenn.eduwww.lrec-conf.orgwww.maltparser.orgwww.microsoft.comwww.mlflow.orgwww.mozilla.orgwww.natcorp.ox.ac.ukwww.nature.comwww.nltk.orgwww.npmjs.comwww.opensource.orgwww.opentable.comwww.oracle.comwww.ota.ahds.ac.ukwww.ota.ox.ac.ukwww.paddleocr.aiwww.patful.comwww.phyast.pitt.eduwww.postgresql.orgwww.psycopg.orgwww.python.orgwww.researchgate.netwww.rethinkdb.comwww.rfc-editor.orgwww.sbert.netwww.searchapi.iowww.senseval.orgwww.siglex.orgwww.sinica.edu.twwww.sqlite.orgwww.stanford.eduwww.starlette.devwww.starlette.iowww.statmt.orgwww.talkbank.orgwww.tartarus.orgwww.tei-c.orgwww.tensorflow.orgwww.tiktok.comwww.umiacs.umd.eduwww.unicode.orgwww.w3.orgwww.wandb.comwww.xudongz.comwww.youtube-nocookie.comwww.youtube.comwww.zetetic.netwww.аррӏе.comxx.comxn--fiqs8s.icom.museumydc-index.ioyour-company.comyoutu.beyoutube.comтест中国.icom.museum실례.com

high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/config.py:184 → repo/backend/open_webui/config.py:188
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/config.py:184 → repo/backend/open_webui/config.py:196
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/config.py:184 → repo/backend/open_webui/config.py:205
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:69 → repo/backend/open_webui/retrieval/loaders/datalab_marker.py:71
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:89 → repo/backend/open_webui/retrieval/loaders/datalab_marker.py:112
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:89 → repo/backend/open_webui/retrieval/loaders/datalab_marker.py:147
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/external_document.py:45 → repo/backend/open_webui/retrieval/loaders/external_document.py:62
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/main.py:195 → repo/backend/open_webui/retrieval/loaders/main.py:197
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/microsoft_web_iq.py:52 → repo/backend/open_webui/retrieval/loaders/microsoft_web_iq.py:70
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/mineru.py:216 → repo/backend/open_webui/retrieval/loaders/mineru.py:239
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/mineru.py:331 → repo/backend/open_webui/retrieval/loaders/mineru.py:341
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/paddleocr_vl.py:45 → repo/backend/open_webui/retrieval/loaders/paddleocr_vl.py:61
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/tavily.py:61 → repo/backend/open_webui/retrieval/loaders/tavily.py:67
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/models/external.py:43 → repo/backend/open_webui/retrieval/models/external.py:49
hub Dependency data flows (7)
high mcp dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:433 → pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:452
high openai dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:218 → pkgs/python/[email protected]/src/openai/lib/azure.py:255
high openai dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:499 → pkgs/python/[email protected]/src/openai/lib/azure.py:536
high transformers dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2466 → pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2493
high transformers dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2466 → pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2494
high transformers dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/transformers/utils/hub.py:163 → pkgs/python/[email protected]/src/transformers/utils/hub.py:163
high google-cloud-storage dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/google/cloud/storage/asyncio/retry/writes_resumption_strategy.py:74 → pkgs/python/[email protected]/google/cloud/storage/asyncio/retry/writes_resumption_strategy.py:97

</> First-Party Code

first-party (python)

python first-party
high pii_flow production #5c532610ea161013 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/config.py:188 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/config.py:184 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/config.py:188 
        r = requests.get(f'https://api.openwebui.com/api/v1/custom/{CUSTOM_NAME}')

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #0c83422bbec31e71 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/config.py:196 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/config.py:184 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/config.py:196 
                r = requests.get(url, stream=True)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #7c271ad9190db101 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/config.py:205 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/config.py:184 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/config.py:205 
                r = requests.get(url, stream=True)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #cf9effd067136f51 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:71 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/datalab_marker.py:69 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/datalab_marker.py:71 
            response = requests.get(url, headers=headers)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #b7494fef456260f4 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:112 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/datalab_marker.py:89 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/datalab_marker.py:112 
                response = requests.post(
                    f'{self.api_base_url}',
                    data=form_data,
                    files=files,
                    headers=headers,
                )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #7fb9968bc55c2011 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:147 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/datalab_marker.py:89 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/datalab_marker.py:147 
                    poll_response = requests.get(check_url, headers=headers)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #0a449ab4c34867c5 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/external_document.py:62 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/external_document.py:45 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/external_document.py:62 
            response = requests.put(f'{url}/process', data=data, headers=headers)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #437f4c10ac1b841e — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/main.py:197 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/main.py:195 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/main.py:197 
            r = requests.post(
                f'{self.url}/v1/convert/file',
                files={
                    'files': (
                        self.file_path,
                        f,
                        self.mime_type or 'application/octet-stream',
                    )
                },
                data={
                    'image_export_mode': 'placeholder',
                    'md_page_break_placeholder': page_break_marker,
                    **self.params,
                },
                headers=headers,
                verify=AIOHTTP_CLIENT_SESSION_SSL,
            )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #086107a78344c239 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/microsoft_web_iq.py:70 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/microsoft_web_iq.py:52 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/microsoft_web_iq.py:70 
            response = requests.post(
                f'{self.api_base_url}/browse',
                json=payload,
                headers=headers,
                timeout=request_timeout,
                verify=self.verify_ssl,
            )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #31d4f7806f89b93e — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/mineru.py:239 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/mineru.py:216 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/mineru.py:239 
            response = requests.post(
                f'{self.api_url}/file-urls/batch',
                headers=headers,
                json=request_body,
                timeout=30,
            )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #f30f7dd16b7519c2 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/mineru.py:341 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/mineru.py:331 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/mineru.py:341 
                response = requests.get(
                    f'{self.api_url}/extract-results/batch/{batch_id}',
                    headers=headers,
                    timeout=30,
                )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #66e15de415048ed6 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/paddleocr_vl.py:61 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/paddleocr_vl.py:45 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/paddleocr_vl.py:61 
            response = requests.post(f'{self.api_url}/layout-parsing', json=payload, headers=headers)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #d7b2e461cb01c46f — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/loaders/tavily.py:67 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/tavily.py:61 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/loaders/tavily.py:67 
                response = requests.post(self.api_url, headers=headers, json=payload)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #d6f3c104eff9c0bb — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/backend/open_webui/retrieval/models/external.py:49 · flow /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/models/external.py:43 → /tmp/closeopen-k8eta71w/repo/backend/open_webui/retrieval/models/external.py:49 
            r = requests.post(
                f'{self.url}',
                headers=headers,
                json=payload,
                timeout=self.timeout,
                verify=REQUESTS_VERIFY,
            )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
medium telemetry production #b931c61b38e2eb67 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/auth.py:346 
            from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #0bbb9c8895b71cf2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/auth.py:391 
                    from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #8726c4bfe1020b34 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/auth.py:465 
        from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #ec4b598f52853ba9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/logger.py:123 
        from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 904 low-confidence finding(s)
low env_fs production #8333f7bcd31b0b8e — Environment-variable access.
repo/backend/open_webui/__init__.py:37 
    os.environ['FROM_INIT_PY'] = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #deb5ab588d569098 — Environment-variable access.
repo/backend/open_webui/__init__.py:38 
    if os.getenv('WEBUI_SECRET_KEY') is None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be32eedef945d00b — Environment-variable access.
repo/backend/open_webui/__init__.py:41 
            key_length = int(os.getenv('WEBUI_SECRET_KEY_LENGTH', DEFAULT_SECRET_KEY_LENGTH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #acd827fadc6d1e71 — Environment-variable access.
repo/backend/open_webui/__init__.py:47 
        os.environ['WEBUI_SECRET_KEY'] = KEY_FILE.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2dc1335fbfc19c14 — Filesystem access.
repo/backend/open_webui/__init__.py:47 
        os.environ['WEBUI_SECRET_KEY'] = KEY_FILE.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd413a166818b51f — Environment-variable access.
repo/backend/open_webui/__init__.py:49 
    if os.getenv('USE_CUDA_DOCKER', 'false') == 'true':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3433f1557eb5ba0 — Environment-variable access.
repo/backend/open_webui/__init__.py:51 
        LD_LIBRARY_PATH = os.getenv('LD_LIBRARY_PATH', '').split(':')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #60ec94163257bda9 — Environment-variable access.
repo/backend/open_webui/__init__.py:52 
        os.environ['LD_LIBRARY_PATH'] = ':'.join(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #00bd467859afb731 — Environment-variable access.
repo/backend/open_webui/__init__.py:70 
            os.environ['USE_CUDA_DOCKER'] = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #947b80ae6d79105c — Environment-variable access.
repo/backend/open_webui/__init__.py:71 
            os.environ['LD_LIBRARY_PATH'] = ':'.join(LD_LIBRARY_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ae630d630df07d7f — Filesystem access.
repo/backend/open_webui/config.py:86 
    with open(f'{DATA_DIR}/config.json', 'r') as _f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b081496217d23907 — Environment-variable access.
repo/backend/open_webui/config.py:95 
STATIC_DIR = Path(os.getenv('STATIC_DIR', OPEN_WEBUI_DIR / 'static')).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71df82794b45affa — Environment-variable access.
repo/backend/open_webui/config.py:144 
STORAGE_PROVIDER = os.getenv('STORAGE_PROVIDER', 'local')  # defaults to local, s3

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #afc1b4295adcbf0b — Environment-variable access.
repo/backend/open_webui/config.py:145 
STORAGE_LOCAL_CACHE = os.getenv('STORAGE_LOCAL_CACHE', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37ba1993c0a76a8a — Environment-variable access.
repo/backend/open_webui/config.py:147 
S3_ACCESS_KEY_ID = os.getenv('S3_ACCESS_KEY_ID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #55ad4f3fde6064d6 — Environment-variable access.
repo/backend/open_webui/config.py:148 
S3_SECRET_ACCESS_KEY = os.getenv('S3_SECRET_ACCESS_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e05cec28e773d02 — Environment-variable access.
repo/backend/open_webui/config.py:149 
S3_REGION_NAME = os.getenv('S3_REGION_NAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e3985ca3175156e8 — Environment-variable access.
repo/backend/open_webui/config.py:150 
S3_BUCKET_NAME = os.getenv('S3_BUCKET_NAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06fbc20167c9c532 — Environment-variable access.
repo/backend/open_webui/config.py:151 
S3_KEY_PREFIX = os.getenv('S3_KEY_PREFIX', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83089f7ec5525fb2 — Environment-variable access.
repo/backend/open_webui/config.py:152 
S3_ENDPOINT_URL = os.getenv('S3_ENDPOINT_URL', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d548903d0118e98 — Environment-variable access.
repo/backend/open_webui/config.py:153 
S3_USE_ACCELERATE_ENDPOINT = os.getenv('S3_USE_ACCELERATE_ENDPOINT', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1bab809bd1922cad — Environment-variable access.
repo/backend/open_webui/config.py:154 
S3_ADDRESSING_STYLE = os.getenv('S3_ADDRESSING_STYLE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc1eb8c9d068937e — Environment-variable access.
repo/backend/open_webui/config.py:155 
S3_ENABLE_TAGGING = os.getenv('S3_ENABLE_TAGGING', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #66d7f470898d02fc — Environment-variable access.
repo/backend/open_webui/config.py:157 
GCS_BUCKET_NAME = os.getenv('GCS_BUCKET_NAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f5660155e4280700 — Environment-variable access.
repo/backend/open_webui/config.py:158 
GOOGLE_APPLICATION_CREDENTIALS_JSON = os.getenv('GOOGLE_APPLICATION_CREDENTIALS_JSON', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8c6b1e684c9b32c6 — Environment-variable access.
repo/backend/open_webui/config.py:160 
AZURE_STORAGE_ENDPOINT = os.getenv('AZURE_STORAGE_ENDPOINT', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #976392ccf9384b21 — Environment-variable access.
repo/backend/open_webui/config.py:161 
AZURE_STORAGE_CONTAINER_NAME = os.getenv('AZURE_STORAGE_CONTAINER_NAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #034071598719d27d — Environment-variable access.
repo/backend/open_webui/config.py:162 
AZURE_STORAGE_KEY = os.getenv('AZURE_STORAGE_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ccfd1a839385c4d6 — Environment-variable access.
repo/backend/open_webui/config.py:184 
CUSTOM_NAME = os.getenv('CUSTOM_NAME', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e084cbdb0046697 — Filesystem access.
repo/backend/open_webui/config.py:198 
                    with open(f'{STATIC_DIR}/favicon.png', 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5e9ba97c2bccfbb4 — Filesystem access.
repo/backend/open_webui/config.py:207 
                    with open(f'{STATIC_DIR}/splash.png', 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b77176e774aaddb — Environment-variable access.
repo/backend/open_webui/config.py:221 
ENABLE_DIRECT_CONNECTIONS = os.getenv('ENABLE_DIRECT_CONNECTIONS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df816789018e1efc — Environment-variable access.
repo/backend/open_webui/config.py:227 
ENABLE_OLLAMA_API = os.getenv('ENABLE_OLLAMA_API', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #397dfa5ca7a95fcc — Environment-variable access.
repo/backend/open_webui/config.py:229 
OLLAMA_API_BASE_URL = os.getenv('OLLAMA_API_BASE_URL', 'http://localhost:11434/api')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c406baa8385463c8 — Environment-variable access.
repo/backend/open_webui/config.py:231 
OLLAMA_BASE_URL = os.getenv('OLLAMA_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dfc1f673ba047382 — Environment-variable access.
repo/backend/open_webui/config.py:237 
K8S_FLAG = os.getenv('K8S_FLAG', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13117d648e209bfb — Environment-variable access.
repo/backend/open_webui/config.py:238 
USE_OLLAMA_DOCKER = os.getenv('USE_OLLAMA_DOCKER', 'false')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f288c4bf1644fdab — Environment-variable access.
repo/backend/open_webui/config.py:282 
if os.getenv('OLLAMA_BASE_URL', '') in ('', '/ollama') and not os.getenv('OLLAMA_BASE_URLS', ''):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #796f6699db2a2715 — Environment-variable access.
repo/backend/open_webui/config.py:286 
OLLAMA_BASE_URLS = os.getenv('OLLAMA_BASE_URLS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fefee41511b09f23 — Environment-variable access.
repo/backend/open_webui/config.py:293 
_ollama_api_configs = os.getenv('OLLAMA_API_CONFIGS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a6c435a0521b3c7 — Environment-variable access.
repo/backend/open_webui/config.py:309 
ENABLE_OPENAI_API = os.getenv('ENABLE_OPENAI_API', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #836add8f7cf9d2da — Environment-variable access.
repo/backend/open_webui/config.py:312 
OPENAI_API_KEY = os.getenv('OPENAI_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #154cee1593d93c82 — Environment-variable access.
repo/backend/open_webui/config.py:313 
OPENAI_API_BASE_URL = os.getenv('OPENAI_API_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be184fa2693babf1 — Environment-variable access.
repo/backend/open_webui/config.py:315 
GEMINI_API_KEY = os.getenv('GEMINI_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #834f714b855e9e8d — Environment-variable access.
repo/backend/open_webui/config.py:316 
GEMINI_API_BASE_URL = os.getenv('GEMINI_API_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c137cf20ccc8dbc9 — Environment-variable access.
repo/backend/open_webui/config.py:325 
OPENAI_API_KEYS = os.getenv('OPENAI_API_KEYS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #89fac594f3ae4f69 — Environment-variable access.
repo/backend/open_webui/config.py:331 
OPENAI_API_BASE_URLS = os.getenv('OPENAI_API_BASE_URLS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09fd338f68b777cc — Environment-variable access.
repo/backend/open_webui/config.py:340 
_openai_api_configs = os.getenv('OPENAI_API_CONFIGS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aebaeb7dd1884b6e — Environment-variable access.
repo/backend/open_webui/config.py:364 
ENABLE_BASE_MODELS_CACHE = os.getenv('ENABLE_BASE_MODELS_CACHE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dbebf99f3f4b49e4 — Environment-variable access.
repo/backend/open_webui/config.py:372 
    tool_server_connections = json.loads(os.getenv('TOOL_SERVER_CONNECTIONS', '[]'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6f938121dc12af29 — Environment-variable access.
repo/backend/open_webui/config.py:380 
OAUTH_CLIENT_TIMEOUT = os.getenv('OAUTH_CLIENT_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b6bb47f7d42debcd — Environment-variable access.
repo/backend/open_webui/config.py:386 
terminal_server_connections = json.loads(os.getenv('TERMINAL_SERVER_CONNECTIONS', '[]'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5f927acddda49b51 — Environment-variable access.
repo/backend/open_webui/config.py:391 
    TERMINAL_PROXY_HEADERS = json.loads(os.getenv('TERMINAL_PROXY_HEADERS', '{}'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d42f49d75783313a — Environment-variable access.
repo/backend/open_webui/config.py:399 
ENABLE_CODE_EXECUTION = os.getenv('ENABLE_CODE_EXECUTION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d568ccae898d9f12 — Environment-variable access.
repo/backend/open_webui/config.py:401 
CODE_EXECUTION_ENGINE = os.getenv('CODE_EXECUTION_ENGINE', 'pyodide')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5580a292b814510e — Environment-variable access.
repo/backend/open_webui/config.py:403 
CODE_EXECUTION_JUPYTER_URL = os.getenv('CODE_EXECUTION_JUPYTER_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #286a10f3d290aa04 — Environment-variable access.
repo/backend/open_webui/config.py:405 
CODE_EXECUTION_JUPYTER_AUTH = os.getenv('CODE_EXECUTION_JUPYTER_AUTH', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #250715722f1b6a6a — Environment-variable access.
repo/backend/open_webui/config.py:407 
CODE_EXECUTION_JUPYTER_AUTH_TOKEN = os.getenv('CODE_EXECUTION_JUPYTER_AUTH_TOKEN', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b5d3df8feddea690 — Environment-variable access.
repo/backend/open_webui/config.py:410 
CODE_EXECUTION_JUPYTER_AUTH_PASSWORD = os.getenv('CODE_EXECUTION_JUPYTER_AUTH_PASSWORD', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f25a0c8734d58c84 — Environment-variable access.
repo/backend/open_webui/config.py:412 
CODE_EXECUTION_JUPYTER_TIMEOUT = int(os.getenv('CODE_EXECUTION_JUPYTER_TIMEOUT', '60'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ea3223e7302d84fd — Environment-variable access.
repo/backend/open_webui/config.py:414 
ENABLE_CODE_INTERPRETER = os.getenv('ENABLE_CODE_INTERPRETER', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #356a3c07a244b68f — Environment-variable access.
repo/backend/open_webui/config.py:416 
ENABLE_MEMORIES = os.getenv('ENABLE_MEMORIES', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4216604c55f99ea5 — Environment-variable access.
repo/backend/open_webui/config.py:417 
ENABLE_MEMORY_SYSTEM_CONTEXT = os.getenv('ENABLE_MEMORY_SYSTEM_CONTEXT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #58b8547b5823ebf7 — Environment-variable access.
repo/backend/open_webui/config.py:418 
ENABLE_MEMORY_BACKGROUND_REVIEW = os.getenv('ENABLE_MEMORY_BACKGROUND_REVIEW', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1fd5831d2893451a — Environment-variable access.
repo/backend/open_webui/config.py:419 
MEMORIES_REVIEW_INTERVAL_TURNS = int(os.getenv('MEMORIES_REVIEW_INTERVAL_TURNS', '10'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0440a6b7aef653c9 — Environment-variable access.
repo/backend/open_webui/config.py:420 
MEMORIES_USER_CHAR_LIMIT = int(os.getenv('MEMORIES_USER_CHAR_LIMIT', '2000'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #824c3081c74e876f — Environment-variable access.
repo/backend/open_webui/config.py:421 
MEMORIES_CONTEXT_CHAR_LIMIT = int(os.getenv('MEMORIES_CONTEXT_CHAR_LIMIT', '2000'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10a24f89146b5429 — Environment-variable access.
repo/backend/open_webui/config.py:423 
CODE_INTERPRETER_ENGINE = os.getenv('CODE_INTERPRETER_ENGINE', 'pyodide')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #02c7f526c14603f1 — Environment-variable access.
repo/backend/open_webui/config.py:425 
CODE_INTERPRETER_PROMPT_TEMPLATE = os.getenv('CODE_INTERPRETER_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b92943a5e080a33 — Environment-variable access.
repo/backend/open_webui/config.py:427 
CODE_INTERPRETER_JUPYTER_URL = os.getenv('CODE_INTERPRETER_JUPYTER_URL', os.getenv('CODE_EXECUTION_JUPYTER_URL', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f81ff418f7fd3a23 — Environment-variable access.
repo/backend/open_webui/config.py:429 
CODE_INTERPRETER_JUPYTER_AUTH = os.getenv(
    'CODE_INTERPRETER_JUPYTER_AUTH',
    os.getenv('CODE_EXECUTION_JUPYTER_AUTH', ''),
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #540de80173f5d8ed — Environment-variable access.
repo/backend/open_webui/config.py:431 
    os.getenv('CODE_EXECUTION_JUPYTER_AUTH', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #03f8f09c0a494442 — Environment-variable access.
repo/backend/open_webui/config.py:434 
CODE_INTERPRETER_JUPYTER_AUTH_TOKEN = os.getenv(
    'CODE_INTERPRETER_JUPYTER_AUTH_TOKEN',
    os.getenv('CODE_EXECUTION_JUPYTER_AUTH_TOKEN', ''),
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d7e4208f8d6741a — Environment-variable access.
repo/backend/open_webui/config.py:436 
    os.getenv('CODE_EXECUTION_JUPYTER_AUTH_TOKEN', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a0c2d78014d30256 — Environment-variable access.
repo/backend/open_webui/config.py:440 
CODE_INTERPRETER_JUPYTER_AUTH_PASSWORD = os.getenv(
    'CODE_INTERPRETER_JUPYTER_AUTH_PASSWORD',
    os.getenv('CODE_EXECUTION_JUPYTER_AUTH_PASSWORD', ''),
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da0662b7b7f88cec — Environment-variable access.
repo/backend/open_webui/config.py:442 
    os.getenv('CODE_EXECUTION_JUPYTER_AUTH_PASSWORD', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e3d675ac12a209b3 — Environment-variable access.
repo/backend/open_webui/config.py:446 
    os.getenv(
        'CODE_INTERPRETER_JUPYTER_TIMEOUT',
        os.getenv('CODE_EXECUTION_JUPYTER_TIMEOUT', '60'),
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c85a50480587bfad — Environment-variable access.
repo/backend/open_webui/config.py:448 
        os.getenv('CODE_EXECUTION_JUPYTER_TIMEOUT', '60'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #91e4a8a2fabf1db2 — Environment-variable access.
repo/backend/open_webui/config.py:453 
    library.strip() for library in os.getenv('CODE_INTERPRETER_BLOCKED_MODULES', '').split(',') if library.strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e629e4120e8252c — Environment-variable access.
repo/backend/open_webui/config.py:493 
VECTOR_DB = os.getenv('VECTOR_DB', 'chroma')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93c24e8968f26bf8 — Environment-variable access.
repo/backend/open_webui/config.py:501 
    CHROMA_TENANT = os.getenv('CHROMA_TENANT', chromadb.DEFAULT_TENANT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #03128b2a226bf431 — Environment-variable access.
repo/backend/open_webui/config.py:502 
    CHROMA_DATABASE = os.getenv('CHROMA_DATABASE', chromadb.DEFAULT_DATABASE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #27d0c36d4c3ae454 — Environment-variable access.
repo/backend/open_webui/config.py:503 
    CHROMA_HTTP_HOST = os.getenv('CHROMA_HTTP_HOST', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f015b8a0d2219bf9 — Environment-variable access.
repo/backend/open_webui/config.py:504 
    CHROMA_HTTP_PORT = int(os.getenv('CHROMA_HTTP_PORT', '8000'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab351ce57b66bad3 — Environment-variable access.
repo/backend/open_webui/config.py:505 
    CHROMA_CLIENT_AUTH_PROVIDER = os.getenv('CHROMA_CLIENT_AUTH_PROVIDER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94fe00aaa654b1c7 — Environment-variable access.
repo/backend/open_webui/config.py:506 
    CHROMA_CLIENT_AUTH_CREDENTIALS = os.getenv('CHROMA_CLIENT_AUTH_CREDENTIALS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d589f25b6541881e — Environment-variable access.
repo/backend/open_webui/config.py:508 
    CHROMA_HTTP_HEADERS = os.getenv('CHROMA_HTTP_HEADERS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cd97e0f084a2adfc — Environment-variable access.
repo/backend/open_webui/config.py:513 
    CHROMA_HTTP_SSL = os.getenv('CHROMA_HTTP_SSL', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9e425c8500614139 — Environment-variable access.
repo/backend/open_webui/config.py:518 
MARIADB_VECTOR_DB_URL = os.getenv('MARIADB_VECTOR_DB_URL', '').strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9099252a92062c6b — Environment-variable access.
repo/backend/open_webui/config.py:521 
    os.getenv('MARIADB_VECTOR_INITIALIZE_MAX_VECTOR_LENGTH', '1536').strip() or '1536'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0bad0d7b266f5fc2 — Environment-variable access.
repo/backend/open_webui/config.py:527 
MARIADB_VECTOR_DISTANCE_STRATEGY = os.getenv('MARIADB_VECTOR_DISTANCE_STRATEGY', 'cosine').strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #585599d7dafdf3e8 — Environment-variable access.
repo/backend/open_webui/config.py:530 
MARIADB_VECTOR_INDEX_M = int(os.getenv('MARIADB_VECTOR_INDEX_M', '8').strip() or '8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cfdb0a72733ff9b1 — Environment-variable access.
repo/backend/open_webui/config.py:533 
MARIADB_VECTOR_POOL_SIZE = os.getenv('MARIADB_VECTOR_POOL_SIZE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d8a35af3534b493 — Environment-variable access.
repo/backend/open_webui/config.py:541 
MARIADB_VECTOR_POOL_MAX_OVERFLOW = os.getenv('MARIADB_VECTOR_POOL_MAX_OVERFLOW', 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #122d34c5e589665a — Environment-variable access.
repo/backend/open_webui/config.py:551 
MARIADB_VECTOR_POOL_TIMEOUT = os.getenv('MARIADB_VECTOR_POOL_TIMEOUT', 30)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f95652f45dae3eba — Environment-variable access.
repo/backend/open_webui/config.py:561 
MARIADB_VECTOR_POOL_RECYCLE = os.getenv('MARIADB_VECTOR_POOL_RECYCLE', 3600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b70e627571cea47 — Environment-variable access.
repo/backend/open_webui/config.py:587 
MILVUS_URI = os.getenv('MILVUS_URI', f'{DATA_DIR}/vector_db/milvus.db')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c847c0f95fe574d — Environment-variable access.
repo/backend/open_webui/config.py:588 
MILVUS_DB = os.getenv('MILVUS_DB', 'default')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #337c12cecc68caa0 — Environment-variable access.
repo/backend/open_webui/config.py:589 
MILVUS_TOKEN = os.getenv('MILVUS_TOKEN', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #982286482dc9de37 — Environment-variable access.
repo/backend/open_webui/config.py:590 
MILVUS_INDEX_TYPE = os.getenv('MILVUS_INDEX_TYPE', 'HNSW')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a8adf22981370244 — Environment-variable access.
repo/backend/open_webui/config.py:591 
MILVUS_METRIC_TYPE = os.getenv('MILVUS_METRIC_TYPE', 'COSINE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #afd85de5d754896d — Environment-variable access.
repo/backend/open_webui/config.py:592 
MILVUS_HNSW_M = int(os.getenv('MILVUS_HNSW_M', '16'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f579a3abdcccdb65 — Environment-variable access.
repo/backend/open_webui/config.py:593 
MILVUS_HNSW_EFCONSTRUCTION = int(os.getenv('MILVUS_HNSW_EFCONSTRUCTION', '100'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d0361ab0b9b6543 — Environment-variable access.
repo/backend/open_webui/config.py:594 
MILVUS_IVF_FLAT_NLIST = int(os.getenv('MILVUS_IVF_FLAT_NLIST', '128'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e56f740d3cbbea13 — Environment-variable access.
repo/backend/open_webui/config.py:595 
MILVUS_DISKANN_MAX_DEGREE = int(os.getenv('MILVUS_DISKANN_MAX_DEGREE', '56'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d8379dcc9368a0c4 — Environment-variable access.
repo/backend/open_webui/config.py:596 
MILVUS_DISKANN_SEARCH_LIST_SIZE = int(os.getenv('MILVUS_DISKANN_SEARCH_LIST_SIZE', '100'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9a40e06c9ad84db9 — Environment-variable access.
repo/backend/open_webui/config.py:597 
ENABLE_MILVUS_MULTITENANCY_MODE = os.getenv('ENABLE_MILVUS_MULTITENANCY_MODE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bf8c1fe071960cde — Environment-variable access.
repo/backend/open_webui/config.py:599 
MILVUS_COLLECTION_PREFIX = os.getenv('MILVUS_COLLECTION_PREFIX', 'open_webui')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f7f5228e25951b5d — Environment-variable access.
repo/backend/open_webui/config.py:602 
QDRANT_URI = os.getenv('QDRANT_URI', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4ec7baffff29fc1 — Environment-variable access.
repo/backend/open_webui/config.py:603 
QDRANT_API_KEY = os.getenv('QDRANT_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #895a1f62a4c49ea2 — Environment-variable access.
repo/backend/open_webui/config.py:604 
QDRANT_ON_DISK = os.getenv('QDRANT_ON_DISK', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6e84ebf3f3337255 — Environment-variable access.
repo/backend/open_webui/config.py:605 
QDRANT_PREFER_GRPC = os.getenv('QDRANT_PREFER_GRPC', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6696e9fee69cf9c0 — Environment-variable access.
repo/backend/open_webui/config.py:606 
QDRANT_GRPC_PORT = int(os.getenv('QDRANT_GRPC_PORT', '6334'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb6fd7afc71ef456 — Environment-variable access.
repo/backend/open_webui/config.py:607 
QDRANT_TIMEOUT = int(os.getenv('QDRANT_TIMEOUT', '5'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb8836d515ecc843 — Environment-variable access.
repo/backend/open_webui/config.py:608 
QDRANT_HNSW_M = int(os.getenv('QDRANT_HNSW_M', '16'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0190d3962f39749a — Environment-variable access.
repo/backend/open_webui/config.py:609 
ENABLE_QDRANT_MULTITENANCY_MODE = os.getenv('ENABLE_QDRANT_MULTITENANCY_MODE', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #786409bf98013009 — Environment-variable access.
repo/backend/open_webui/config.py:610 
QDRANT_COLLECTION_PREFIX = os.getenv('QDRANT_COLLECTION_PREFIX', 'open-webui')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a957055628432345 — Environment-variable access.
repo/backend/open_webui/config.py:612 
WEAVIATE_HTTP_HOST = os.getenv('WEAVIATE_HTTP_HOST', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #33362d65d166940a — Environment-variable access.
repo/backend/open_webui/config.py:613 
WEAVIATE_GRPC_HOST = os.getenv('WEAVIATE_GRPC_HOST', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a23a164646eb698f — Environment-variable access.
repo/backend/open_webui/config.py:614 
WEAVIATE_HTTP_PORT = int(os.getenv('WEAVIATE_HTTP_PORT', '8080'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #27d6a922ed77c0f8 — Environment-variable access.
repo/backend/open_webui/config.py:615 
WEAVIATE_GRPC_PORT = int(os.getenv('WEAVIATE_GRPC_PORT', '50051'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be5797ce1aa6cfea — Environment-variable access.
repo/backend/open_webui/config.py:616 
WEAVIATE_API_KEY = os.getenv('WEAVIATE_API_KEY')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eaa247e5a2d5d630 — Environment-variable access.
repo/backend/open_webui/config.py:617 
WEAVIATE_HTTP_SECURE = os.getenv('WEAVIATE_HTTP_SECURE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b895f3c3f1f790a — Environment-variable access.
repo/backend/open_webui/config.py:618 
WEAVIATE_GRPC_SECURE = os.getenv('WEAVIATE_GRPC_SECURE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5458806b1b7075e8 — Environment-variable access.
repo/backend/open_webui/config.py:619 
WEAVIATE_SKIP_INIT_CHECKS = os.getenv('WEAVIATE_SKIP_INIT_CHECKS', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8b9d72887da58b36 — Environment-variable access.
repo/backend/open_webui/config.py:622 
OPENSEARCH_URI = os.getenv('OPENSEARCH_URI', 'https://localhost:9200')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07bb6dca5a13103b — Environment-variable access.
repo/backend/open_webui/config.py:623 
OPENSEARCH_SSL = os.getenv('OPENSEARCH_SSL', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c068479f48ce7057 — Environment-variable access.
repo/backend/open_webui/config.py:624 
OPENSEARCH_CERT_VERIFY = os.getenv('OPENSEARCH_CERT_VERIFY', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c9f3164328ffb87 — Environment-variable access.
repo/backend/open_webui/config.py:625 
OPENSEARCH_USERNAME = os.getenv('OPENSEARCH_USERNAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4c5e2dc5568f0a21 — Environment-variable access.
repo/backend/open_webui/config.py:626 
OPENSEARCH_PASSWORD = os.getenv('OPENSEARCH_PASSWORD', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a26cabf38d8c0a14 — Environment-variable access.
repo/backend/open_webui/config.py:629 
ELASTICSEARCH_URL = os.getenv('ELASTICSEARCH_URL', 'https://localhost:9200')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f812374fba491f82 — Environment-variable access.
repo/backend/open_webui/config.py:630 
ELASTICSEARCH_CA_CERTS = os.getenv('ELASTICSEARCH_CA_CERTS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b1c6714d3f6b2e06 — Environment-variable access.
repo/backend/open_webui/config.py:631 
ELASTICSEARCH_API_KEY = os.getenv('ELASTICSEARCH_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f605da1cc2808efd — Environment-variable access.
repo/backend/open_webui/config.py:632 
ELASTICSEARCH_USERNAME = os.getenv('ELASTICSEARCH_USERNAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a7e9bda242cefb2 — Environment-variable access.
repo/backend/open_webui/config.py:633 
ELASTICSEARCH_PASSWORD = os.getenv('ELASTICSEARCH_PASSWORD', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b97112d87974ac2 — Environment-variable access.
repo/backend/open_webui/config.py:634 
ELASTICSEARCH_CLOUD_ID = os.getenv('ELASTICSEARCH_CLOUD_ID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc5b54c2be331e1c — Environment-variable access.
repo/backend/open_webui/config.py:635 
SSL_ASSERT_FINGERPRINT = os.getenv('SSL_ASSERT_FINGERPRINT', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df461ffb8753dd2e — Environment-variable access.
repo/backend/open_webui/config.py:636 
ELASTICSEARCH_INDEX_PREFIX = os.getenv('ELASTICSEARCH_INDEX_PREFIX', 'open_webui_collections')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe8e283533ddcbe5 — Environment-variable access.
repo/backend/open_webui/config.py:638 
PGVECTOR_DB_URL = os.getenv('PGVECTOR_DB_URL', DATABASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad387498cef9b97b — Environment-variable access.
repo/backend/open_webui/config.py:643 
PGVECTOR_INITIALIZE_MAX_VECTOR_LENGTH = int(os.getenv('PGVECTOR_INITIALIZE_MAX_VECTOR_LENGTH', '1536'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7dc78cb14c3014bb — Environment-variable access.
repo/backend/open_webui/config.py:645 
PGVECTOR_USE_HALFVEC = os.getenv('PGVECTOR_USE_HALFVEC', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ba5f375ee3b4c8ef — Environment-variable access.
repo/backend/open_webui/config.py:655 
PGVECTOR_CREATE_EXTENSION = os.getenv('PGVECTOR_CREATE_EXTENSION', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cf4db4126a3942ce — Environment-variable access.
repo/backend/open_webui/config.py:656 
PGVECTOR_PGCRYPTO = os.getenv('PGVECTOR_PGCRYPTO', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d3839bf60ea25e12 — Environment-variable access.
repo/backend/open_webui/config.py:657 
PGVECTOR_PGCRYPTO_KEY = os.getenv('PGVECTOR_PGCRYPTO_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #331c7e97bd22f1d4 — Environment-variable access.
repo/backend/open_webui/config.py:662 
PGVECTOR_POOL_SIZE = os.getenv('PGVECTOR_POOL_SIZE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #229d75c7c7aa08cd — Environment-variable access.
repo/backend/open_webui/config.py:670 
PGVECTOR_POOL_MAX_OVERFLOW = os.getenv('PGVECTOR_POOL_MAX_OVERFLOW', 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed5dcc602030fbe1 — Environment-variable access.
repo/backend/open_webui/config.py:680 
PGVECTOR_POOL_TIMEOUT = os.getenv('PGVECTOR_POOL_TIMEOUT', 30)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #712c99f1760bbeb0 — Environment-variable access.
repo/backend/open_webui/config.py:690 
PGVECTOR_POOL_RECYCLE = os.getenv('PGVECTOR_POOL_RECYCLE', 3600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #89979fcb4a820136 — Environment-variable access.
repo/backend/open_webui/config.py:700 
PGVECTOR_INDEX_METHOD = os.getenv('PGVECTOR_INDEX_METHOD', '').strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #900c62b303470765 — Environment-variable access.
repo/backend/open_webui/config.py:704 
PGVECTOR_HNSW_M = os.getenv('PGVECTOR_HNSW_M', 16)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #16bc28b746a79998 — Environment-variable access.
repo/backend/open_webui/config.py:714 
PGVECTOR_HNSW_EF_CONSTRUCTION = os.getenv('PGVECTOR_HNSW_EF_CONSTRUCTION', 64)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ceecdfe1a4c532bc — Environment-variable access.
repo/backend/open_webui/config.py:724 
PGVECTOR_IVFFLAT_LISTS = os.getenv('PGVECTOR_IVFFLAT_LISTS', 100)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #491b74ed3493d0cd — Environment-variable access.
repo/backend/open_webui/config.py:735 
OPENGAUSS_DB_URL = os.getenv('OPENGAUSS_DB_URL', DATABASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fbad9021680a16e3 — Environment-variable access.
repo/backend/open_webui/config.py:737 
OPENGAUSS_INITIALIZE_MAX_VECTOR_LENGTH = int(os.getenv('OPENGAUSS_INITIALIZE_MAX_VECTOR_LENGTH', '1536'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab48a2c998855271 — Environment-variable access.
repo/backend/open_webui/config.py:739 
OPENGAUSS_POOL_SIZE = os.getenv('OPENGAUSS_POOL_SIZE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #76de107830f19066 — Environment-variable access.
repo/backend/open_webui/config.py:747 
OPENGAUSS_POOL_MAX_OVERFLOW = os.getenv('OPENGAUSS_POOL_MAX_OVERFLOW', 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bba1937fa7ee56a5 — Environment-variable access.
repo/backend/open_webui/config.py:757 
OPENGAUSS_POOL_TIMEOUT = os.getenv('OPENGAUSS_POOL_TIMEOUT', 30)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1cf5923159a7571 — Environment-variable access.
repo/backend/open_webui/config.py:767 
OPENGAUSS_POOL_RECYCLE = os.getenv('OPENGAUSS_POOL_RECYCLE', 3600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3dc2f887028cb322 — Environment-variable access.
repo/backend/open_webui/config.py:778 
PINECONE_API_KEY = os.getenv('PINECONE_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cdfbc570f1649f8e — Environment-variable access.
repo/backend/open_webui/config.py:779 
PINECONE_ENVIRONMENT = os.getenv('PINECONE_ENVIRONMENT', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ddf26878261ef1b — Environment-variable access.
repo/backend/open_webui/config.py:780 
PINECONE_INDEX_NAME = os.getenv('PINECONE_INDEX_NAME', 'open-webui-index')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b61fed27d543237 — Environment-variable access.
repo/backend/open_webui/config.py:781 
PINECONE_DIMENSION = int(os.getenv('PINECONE_DIMENSION', 1536))  # or 3072, 1024, 768

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07e14ba7dc14e52e — Environment-variable access.
repo/backend/open_webui/config.py:782 
PINECONE_METRIC = os.getenv('PINECONE_METRIC', 'cosine')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a4da9730dd7281b — Environment-variable access.
repo/backend/open_webui/config.py:783 
PINECONE_CLOUD = os.getenv('PINECONE_CLOUD', 'aws')  # or "gcp" or "azure"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37c7d6fd81a76550 — Environment-variable access.
repo/backend/open_webui/config.py:787 
ORACLE_DB_USE_WALLET = os.getenv('ORACLE_DB_USE_WALLET', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79e375bccc5c932d — Environment-variable access.
repo/backend/open_webui/config.py:788 
ORACLE_DB_USER = os.getenv('ORACLE_DB_USER', None)  #

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d578894bb6a34858 — Environment-variable access.
repo/backend/open_webui/config.py:789 
ORACLE_DB_PASSWORD = os.getenv('ORACLE_DB_PASSWORD', None)  #

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5f0618a162de41d7 — Environment-variable access.
repo/backend/open_webui/config.py:790 
ORACLE_DB_DSN = os.getenv('ORACLE_DB_DSN', None)  #

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #311b5158fbb913c8 — Environment-variable access.
repo/backend/open_webui/config.py:791 
ORACLE_WALLET_DIR = os.getenv('ORACLE_WALLET_DIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97f1d8ca2634921e — Environment-variable access.
repo/backend/open_webui/config.py:792 
ORACLE_WALLET_PASSWORD = os.getenv('ORACLE_WALLET_PASSWORD', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1d21e768f0cd66a — Environment-variable access.
repo/backend/open_webui/config.py:793 
ORACLE_VECTOR_LENGTH = os.getenv('ORACLE_VECTOR_LENGTH', 768)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5903d52d788de9f3 — Environment-variable access.
repo/backend/open_webui/config.py:795 
ORACLE_DB_POOL_MIN = int(os.getenv('ORACLE_DB_POOL_MIN', 2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0bdba707c0f8e5b9 — Environment-variable access.
repo/backend/open_webui/config.py:796 
ORACLE_DB_POOL_MAX = int(os.getenv('ORACLE_DB_POOL_MAX', 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d3fb3b5931536db0 — Environment-variable access.
repo/backend/open_webui/config.py:797 
ORACLE_DB_POOL_INCREMENT = int(os.getenv('ORACLE_DB_POOL_INCREMENT', 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #35b29bac3b6753b1 — Environment-variable access.
repo/backend/open_webui/config.py:811 
S3_VECTOR_BUCKET_NAME = os.getenv('S3_VECTOR_BUCKET_NAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10e2b978c2d6fa4b — Environment-variable access.
repo/backend/open_webui/config.py:812 
S3_VECTOR_REGION = os.getenv('S3_VECTOR_REGION', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a242e7362e0826ba — Environment-variable access.
repo/backend/open_webui/config.py:815 
VALKEY_URL = os.getenv('VALKEY_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ef98c02c5a5fb81 — Environment-variable access.
repo/backend/open_webui/config.py:816 
VALKEY_COLLECTION_PREFIX = os.getenv('VALKEY_COLLECTION_PREFIX', 'open_webui')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72d7b64206fc9fca — Environment-variable access.
repo/backend/open_webui/config.py:817 
VALKEY_INDEX_TYPE = os.getenv('VALKEY_INDEX_TYPE', 'HNSW').upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9d73fcd418e6821 — Environment-variable access.
repo/backend/open_webui/config.py:818 
VALKEY_DISTANCE_METRIC = os.getenv('VALKEY_DISTANCE_METRIC', 'COSINE').upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4b61c9d96cf7076 — Environment-variable access.
repo/backend/open_webui/config.py:819 
VALKEY_HNSW_M = int(os.getenv('VALKEY_HNSW_M', '16'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #73b6dec51596b456 — Environment-variable access.
repo/backend/open_webui/config.py:820 
VALKEY_HNSW_EF_CONSTRUCTION = int(os.getenv('VALKEY_HNSW_EF_CONSTRUCTION', '200'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d6c64eaaa06539ae — Environment-variable access.
repo/backend/open_webui/config.py:821 
VALKEY_HNSW_EF_RUNTIME = int(os.getenv('VALKEY_HNSW_EF_RUNTIME', '10'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d69bc78235e6735 — Environment-variable access.
repo/backend/open_webui/config.py:829 
ENABLE_GOOGLE_DRIVE_INTEGRATION = os.getenv('ENABLE_GOOGLE_DRIVE_INTEGRATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dbdf0d003204d4be — Environment-variable access.
repo/backend/open_webui/config.py:831 
GOOGLE_DRIVE_CLIENT_ID = os.getenv('GOOGLE_DRIVE_CLIENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a30ae66a42559079 — Environment-variable access.
repo/backend/open_webui/config.py:833 
GOOGLE_DRIVE_API_KEY = os.getenv('GOOGLE_DRIVE_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4531e4a3128a36bb — Environment-variable access.
repo/backend/open_webui/config.py:835 
ENABLE_ONEDRIVE_INTEGRATION = os.getenv('ENABLE_ONEDRIVE_INTEGRATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #adc871c7f1768290 — Environment-variable access.
repo/backend/open_webui/config.py:838 
ONEDRIVE_CLIENT_ID = os.getenv('ONEDRIVE_CLIENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #983c8277c9aa31f9 — Environment-variable access.
repo/backend/open_webui/config.py:839 
ONEDRIVE_CLIENT_ID_PERSONAL = os.getenv('ONEDRIVE_CLIENT_ID_PERSONAL', ONEDRIVE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ce258a14b19e778f — Environment-variable access.
repo/backend/open_webui/config.py:840 
ONEDRIVE_CLIENT_ID_BUSINESS = os.getenv('ONEDRIVE_CLIENT_ID_BUSINESS', ONEDRIVE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8750fb0e80e9c412 — Environment-variable access.
repo/backend/open_webui/config.py:842 
ENABLE_ONEDRIVE_PERSONAL = os.getenv('ENABLE_ONEDRIVE_PERSONAL', 'True').lower() == 'true' and bool(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6ef62575f6cad9fa — Environment-variable access.
repo/backend/open_webui/config.py:845 
ENABLE_ONEDRIVE_BUSINESS = os.getenv('ENABLE_ONEDRIVE_BUSINESS', 'True').lower() == 'true' and bool(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #34f999e1cbd722e4 — Environment-variable access.
repo/backend/open_webui/config.py:849 
ONEDRIVE_SHAREPOINT_URL = os.getenv('ONEDRIVE_SHAREPOINT_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a0b5cfbd109adad7 — Environment-variable access.
repo/backend/open_webui/config.py:851 
ONEDRIVE_SHAREPOINT_TENANT_ID = os.getenv('ONEDRIVE_SHAREPOINT_TENANT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e7917603ce06e20 — Environment-variable access.
repo/backend/open_webui/config.py:854 
CONTENT_EXTRACTION_ENGINE = os.getenv('CONTENT_EXTRACTION_ENGINE', '').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23b2af84683721c6 — Environment-variable access.
repo/backend/open_webui/config.py:856 
DATALAB_MARKER_API_KEY = os.getenv('DATALAB_MARKER_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74a21b5e05e09168 — Environment-variable access.
repo/backend/open_webui/config.py:858 
DATALAB_MARKER_API_BASE_URL = os.getenv('DATALAB_MARKER_API_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1e8f2799d6a046b4 — Environment-variable access.
repo/backend/open_webui/config.py:860 
DATALAB_MARKER_ADDITIONAL_CONFIG = os.getenv('DATALAB_MARKER_ADDITIONAL_CONFIG', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7cda37498f9972f9 — Environment-variable access.
repo/backend/open_webui/config.py:862 
DATALAB_MARKER_USE_LLM = os.getenv('DATALAB_MARKER_USE_LLM', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a208f5637f1fa762 — Environment-variable access.
repo/backend/open_webui/config.py:864 
DATALAB_MARKER_SKIP_CACHE = os.getenv('DATALAB_MARKER_SKIP_CACHE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79911b309be6306c — Environment-variable access.
repo/backend/open_webui/config.py:866 
DATALAB_MARKER_FORCE_OCR = os.getenv('DATALAB_MARKER_FORCE_OCR', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c2408a66b88355ce — Environment-variable access.
repo/backend/open_webui/config.py:868 
DATALAB_MARKER_PAGINATE = os.getenv('DATALAB_MARKER_PAGINATE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07390f886cf6744e — Environment-variable access.
repo/backend/open_webui/config.py:870 
DATALAB_MARKER_STRIP_EXISTING_OCR = os.getenv('DATALAB_MARKER_STRIP_EXISTING_OCR', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a512c1e0d705177a — Environment-variable access.
repo/backend/open_webui/config.py:873 
    os.getenv('DATALAB_MARKER_DISABLE_IMAGE_EXTRACTION', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d29f46139e3fcf4 — Environment-variable access.
repo/backend/open_webui/config.py:876 
DATALAB_MARKER_FORMAT_LINES = os.getenv('DATALAB_MARKER_FORMAT_LINES', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ceba247427b706c — Environment-variable access.
repo/backend/open_webui/config.py:878 
DATALAB_MARKER_OUTPUT_FORMAT = os.getenv('DATALAB_MARKER_OUTPUT_FORMAT', 'markdown')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f1dfded95af7d2f — Environment-variable access.
repo/backend/open_webui/config.py:880 
MINERU_API_MODE = os.getenv('MINERU_API_MODE', 'local')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36f9049322e29cb6 — Environment-variable access.
repo/backend/open_webui/config.py:882 
MINERU_API_URL = os.getenv('MINERU_API_URL', 'http://localhost:8000')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d89b139f4588c8c0 — Environment-variable access.
repo/backend/open_webui/config.py:884 
MINERU_API_TIMEOUT = os.getenv('MINERU_API_TIMEOUT', '300')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da956d87ca9f3526 — Environment-variable access.
repo/backend/open_webui/config.py:886 
MINERU_API_KEY = os.getenv('MINERU_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5c396eb92c84d147 — Environment-variable access.
repo/backend/open_webui/config.py:888 
mineru_params = os.getenv('MINERU_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1e79004d3a7e7b67 — Environment-variable access.
repo/backend/open_webui/config.py:896 
MINERU_FILE_EXTENSIONS = [ext.strip() for ext in os.getenv('MINERU_FILE_EXTENSIONS', 'pdf').split(',') if ext.strip()]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a5d715805224ad2e — Environment-variable access.
repo/backend/open_webui/config.py:898 
EXTERNAL_DOCUMENT_LOADER_URL = os.getenv('EXTERNAL_DOCUMENT_LOADER_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #541d52b02cbbd3ba — Environment-variable access.
repo/backend/open_webui/config.py:900 
EXTERNAL_DOCUMENT_LOADER_API_KEY = os.getenv('EXTERNAL_DOCUMENT_LOADER_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b4ee370528753dba — Environment-variable access.
repo/backend/open_webui/config.py:902 
external_document_loader_headers = os.getenv('EXTERNAL_DOCUMENT_LOADER_HEADERS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85fae7b9e39efab5 — Environment-variable access.
repo/backend/open_webui/config.py:912 
TIKA_SERVER_URL = os.getenv('TIKA_SERVER_URL', 'http://tika:9998')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #78295f8b63fe25ef — Environment-variable access.
repo/backend/open_webui/config.py:914 
DOCLING_SERVER_URL = os.getenv('DOCLING_SERVER_URL', 'http://docling:5001')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be2099befcb8a948 — Environment-variable access.
repo/backend/open_webui/config.py:916 
DOCLING_API_KEY = os.getenv('DOCLING_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2de12b65f8982063 — Environment-variable access.
repo/backend/open_webui/config.py:918 
docling_params = os.getenv('DOCLING_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1c49812f12f3a47 — Environment-variable access.
repo/backend/open_webui/config.py:926 
DOCUMENT_INTELLIGENCE_ENDPOINT = os.getenv('DOCUMENT_INTELLIGENCE_ENDPOINT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c5808fb859bb13d2 — Environment-variable access.
repo/backend/open_webui/config.py:928 
DOCUMENT_INTELLIGENCE_KEY = os.getenv('DOCUMENT_INTELLIGENCE_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9284ab4e3934405a — Environment-variable access.
repo/backend/open_webui/config.py:930 
DOCUMENT_INTELLIGENCE_MODEL = os.getenv('DOCUMENT_INTELLIGENCE_MODEL', 'prebuilt-layout')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e8366b71e821a4db — Environment-variable access.
repo/backend/open_webui/config.py:932 
MISTRAL_OCR_API_BASE_URL = os.getenv('MISTRAL_OCR_API_BASE_URL', 'https://api.mistral.ai/v1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77e4efde6902bfe1 — Environment-variable access.
repo/backend/open_webui/config.py:934 
MISTRAL_OCR_API_KEY = os.getenv('MISTRAL_OCR_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db50e6aec2ec0441 — Environment-variable access.
repo/backend/open_webui/config.py:936 
MISTRAL_OCR_USE_BASE64 = os.getenv('MISTRAL_OCR_USE_BASE64', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0326a18f9a098922 — Environment-variable access.
repo/backend/open_webui/config.py:938 
PADDLEOCR_VL_BASE_URL = os.getenv('PADDLEOCR_VL_BASE_URL', 'http://localhost:8080')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b376c8fe37635d75 — Environment-variable access.
repo/backend/open_webui/config.py:940 
PADDLEOCR_VL_TOKEN = os.getenv('PADDLEOCR_VL_TOKEN', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7d322c8ac8b363cf — Environment-variable access.
repo/backend/open_webui/config.py:942 
BYPASS_EMBEDDING_AND_RETRIEVAL = os.getenv('BYPASS_EMBEDDING_AND_RETRIEVAL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a00ae4fb45840f5a — Environment-variable access.
repo/backend/open_webui/config.py:945 
RAG_TOP_K = int(os.getenv('RAG_TOP_K', '3'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3c18f6491e1d0fbd — Environment-variable access.
repo/backend/open_webui/config.py:946 
RAG_TOP_K_RERANKER = int(os.getenv('RAG_TOP_K_RERANKER', '3'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4c8a5d26eb13ecfb — Environment-variable access.
repo/backend/open_webui/config.py:947 
RAG_RELEVANCE_THRESHOLD = float(os.getenv('RAG_RELEVANCE_THRESHOLD', '0.0'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #73673fb7c177b236 — Environment-variable access.
repo/backend/open_webui/config.py:948 
RAG_HYBRID_BM25_WEIGHT = float(os.getenv('RAG_HYBRID_BM25_WEIGHT', '0.5'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d2895dd2b2f97a1 — Environment-variable access.
repo/backend/open_webui/config.py:950 
ENABLE_RAG_HYBRID_SEARCH = os.getenv('ENABLE_RAG_HYBRID_SEARCH', '').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74a3d21a3c69e013 — Environment-variable access.
repo/backend/open_webui/config.py:953 
    os.getenv('ENABLE_RAG_HYBRID_SEARCH_ENRICHED_TEXTS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af97b935a4cf2296 — Environment-variable access.
repo/backend/open_webui/config.py:956 
RAG_FULL_CONTEXT = os.getenv('RAG_FULL_CONTEXT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fad9c5d0e6ed1e6c — Environment-variable access.
repo/backend/open_webui/config.py:958 
RAG_FILE_MAX_COUNT = int(os.getenv('RAG_FILE_MAX_COUNT')) if os.getenv('RAG_FILE_MAX_COUNT') else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e8eb332c76170b38 — Environment-variable access.
repo/backend/open_webui/config.py:960 
RAG_FILE_MAX_SIZE = int(os.getenv('RAG_FILE_MAX_SIZE')) if os.getenv('RAG_FILE_MAX_SIZE') else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #73731e913192cb5d — Environment-variable access.
repo/backend/open_webui/config.py:962 
RAG_FILE_CONTENT_SEARCH_MAX_CHARS = int(os.getenv('RAG_FILE_CONTENT_SEARCH_MAX_CHARS', str(64 * 1024 * 1024)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d52cfdb3e7b018f5 — Environment-variable access.
repo/backend/open_webui/config.py:965 
    int(os.getenv('FILE_IMAGE_COMPRESSION_WIDTH')) if os.getenv('FILE_IMAGE_COMPRESSION_WIDTH') else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12b957c878b5e70f — Environment-variable access.
repo/backend/open_webui/config.py:969 
    int(os.getenv('FILE_IMAGE_COMPRESSION_HEIGHT')) if os.getenv('FILE_IMAGE_COMPRESSION_HEIGHT') else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a36247fa5fac6cda — Environment-variable access.
repo/backend/open_webui/config.py:974 
    ext.strip() for ext in os.getenv('RAG_ALLOWED_FILE_EXTENSIONS', '').split(',') if ext.strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b2f00b57d004eba — Environment-variable access.
repo/backend/open_webui/config.py:977 
RAG_EMBEDDING_ENGINE = os.getenv('RAG_EMBEDDING_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #290f78ed20d677c7 — Environment-variable access.
repo/backend/open_webui/config.py:979 
PDF_EXTRACT_IMAGES = os.getenv('PDF_EXTRACT_IMAGES', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3befa918bc8ec0d4 — Environment-variable access.
repo/backend/open_webui/config.py:981 
PDF_LOADER_MODE = os.getenv('PDF_LOADER_MODE', 'page')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97473936dff205bb — Environment-variable access.
repo/backend/open_webui/config.py:983 
RAG_EMBEDDING_MODEL = os.getenv('RAG_EMBEDDING_MODEL', 'sentence-transformers/all-MiniLM-L6-v2')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cc52e9e447561cdb — Environment-variable access.
repo/backend/open_webui/config.py:986 
RAG_TOKENIZER_MODEL = os.getenv('RAG_TOKENIZER_MODEL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #477f0d04ff3a5f74 — Environment-variable access.
repo/backend/open_webui/config.py:989 
    not OFFLINE_MODE and os.getenv('RAG_EMBEDDING_MODEL_AUTO_UPDATE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b00102f83b085ed — Environment-variable access.
repo/backend/open_webui/config.py:992 
RAG_EMBEDDING_MODEL_TRUST_REMOTE_CODE = os.getenv('RAG_EMBEDDING_MODEL_TRUST_REMOTE_CODE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #08e89f16fd5ddbed — Environment-variable access.
repo/backend/open_webui/config.py:995 
    os.getenv('RAG_EMBEDDING_BATCH_SIZE') or os.getenv('RAG_EMBEDDING_OPENAI_BATCH_SIZE', '1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d505e08b13d3ab9 — Environment-variable access.
repo/backend/open_webui/config.py:998 
ENABLE_ASYNC_EMBEDDING = os.getenv('ENABLE_ASYNC_EMBEDDING', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #760548c598b75d13 — Environment-variable access.
repo/backend/open_webui/config.py:1000 
RAG_EMBEDDING_CONCURRENT_REQUESTS = int(os.getenv('RAG_EMBEDDING_CONCURRENT_REQUESTS', '0'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc0768e64f756268 — Environment-variable access.
repo/backend/open_webui/config.py:1002 
RAG_EMBEDDING_QUERY_PREFIX = os.getenv('RAG_EMBEDDING_QUERY_PREFIX', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #80bbe804df031422 — Environment-variable access.
repo/backend/open_webui/config.py:1004 
RAG_EMBEDDING_CONTENT_PREFIX = os.getenv('RAG_EMBEDDING_CONTENT_PREFIX', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b2b12fcc5ba5921 — Environment-variable access.
repo/backend/open_webui/config.py:1006 
RAG_EMBEDDING_PREFIX_FIELD_NAME = os.getenv('RAG_EMBEDDING_PREFIX_FIELD_NAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #43fb5208dbfc8ff0 — Environment-variable access.
repo/backend/open_webui/config.py:1008 
RAG_RERANKING_ENGINE = os.getenv('RAG_RERANKING_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #15cf93eb62a76ffd — Environment-variable access.
repo/backend/open_webui/config.py:1010 
RAG_RERANKING_MODEL = os.getenv('RAG_RERANKING_MODEL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #355022272dabe525 — Environment-variable access.
repo/backend/open_webui/config.py:1016 
    not OFFLINE_MODE and os.getenv('RAG_RERANKING_MODEL_AUTO_UPDATE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b9e952865dbe622 — Environment-variable access.
repo/backend/open_webui/config.py:1019 
RAG_RERANKING_MODEL_TRUST_REMOTE_CODE = os.getenv('RAG_RERANKING_MODEL_TRUST_REMOTE_CODE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a45bd5ed3768c3c0 — Environment-variable access.
repo/backend/open_webui/config.py:1021 
RAG_RERANKING_BATCH_SIZE = int(os.getenv('RAG_RERANKING_BATCH_SIZE', '32'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc54dac986071264 — Environment-variable access.
repo/backend/open_webui/config.py:1023 
RAG_EXTERNAL_RERANKER_URL = os.getenv('RAG_EXTERNAL_RERANKER_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f602c3a490b5dac7 — Environment-variable access.
repo/backend/open_webui/config.py:1025 
RAG_EXTERNAL_RERANKER_API_KEY = os.getenv('RAG_EXTERNAL_RERANKER_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #89f4894768d0d6cd — Environment-variable access.
repo/backend/open_webui/config.py:1027 
RAG_EXTERNAL_RERANKER_TIMEOUT = os.getenv('RAG_EXTERNAL_RERANKER_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #59c4f45552f3401a — Environment-variable access.
repo/backend/open_webui/config.py:1030 
RAG_TEXT_SPLITTER = os.getenv('RAG_TEXT_SPLITTER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #184466e54c8810ad — Environment-variable access.
repo/backend/open_webui/config.py:1032 
ENABLE_MARKDOWN_HEADER_TEXT_SPLITTER = os.getenv('ENABLE_MARKDOWN_HEADER_TEXT_SPLITTER', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a4a13327db5ba6a — Environment-variable access.
repo/backend/open_webui/config.py:1035 
TIKTOKEN_CACHE_DIR = os.getenv('TIKTOKEN_CACHE_DIR', f'{CACHE_DIR}/tiktoken')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71d4b17e35c73dd6 — Environment-variable access.
repo/backend/open_webui/config.py:1036 
TIKTOKEN_ENCODING_NAME = os.getenv('TIKTOKEN_ENCODING_NAME', 'cl100k_base')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #574ee0101c901e0b — Environment-variable access.
repo/backend/open_webui/config.py:1039 
CHUNK_SIZE = int(os.getenv('CHUNK_SIZE', '1000'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71583798fccec735 — Environment-variable access.
repo/backend/open_webui/config.py:1041 
CHUNK_MIN_SIZE_TARGET = int(os.getenv('CHUNK_MIN_SIZE_TARGET', '0'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d323ed65cf91fb8d — Environment-variable access.
repo/backend/open_webui/config.py:1043 
CHUNK_OVERLAP = int(os.getenv('CHUNK_OVERLAP', '100'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #355b0248f0715f0c — Environment-variable access.
repo/backend/open_webui/config.py:1071 
RAG_TEMPLATE = os.getenv('RAG_TEMPLATE', DEFAULT_RAG_TEMPLATE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40b6b5072ae6de09 — Environment-variable access.
repo/backend/open_webui/config.py:1073 
RAG_OPENAI_API_BASE_URL = os.getenv('RAG_OPENAI_API_BASE_URL', OPENAI_API_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #150ab171f137371a — Environment-variable access.
repo/backend/open_webui/config.py:1074 
RAG_OPENAI_API_KEY = os.getenv('RAG_OPENAI_API_KEY', OPENAI_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e239ecb5d33e897 — Environment-variable access.
repo/backend/open_webui/config.py:1076 
RAG_AZURE_OPENAI_BASE_URL = os.getenv('RAG_AZURE_OPENAI_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d129a7e768d189e7 — Environment-variable access.
repo/backend/open_webui/config.py:1077 
RAG_AZURE_OPENAI_API_KEY = os.getenv('RAG_AZURE_OPENAI_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e1483a300e86d1f4 — Environment-variable access.
repo/backend/open_webui/config.py:1078 
RAG_AZURE_OPENAI_API_VERSION = os.getenv('RAG_AZURE_OPENAI_API_VERSION', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db8c5e4d0ede098e — Environment-variable access.
repo/backend/open_webui/config.py:1080 
RAG_OLLAMA_BASE_URL = os.getenv('RAG_OLLAMA_BASE_URL', OLLAMA_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d8235da3543211fb — Environment-variable access.
repo/backend/open_webui/config.py:1082 
RAG_OLLAMA_API_KEY = os.getenv('RAG_OLLAMA_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92a9916e1b9171df — Environment-variable access.
repo/backend/open_webui/config.py:1086 
    os.getenv(
        'ENABLE_LOCAL_WEB_FETCH',
        os.getenv('ENABLE_RAG_LOCAL_WEB_FETCH', 'False'),
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb2e5718870aaeef — Environment-variable access.
repo/backend/open_webui/config.py:1088 
        os.getenv('ENABLE_RAG_LOCAL_WEB_FETCH', 'False'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c8138df70d7b2e4d — Environment-variable access.
repo/backend/open_webui/config.py:1104 
web_fetch_filter_list = os.getenv('WEB_FETCH_FILTER_LIST', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #725df9dc03f1a557 — Environment-variable access.
repo/backend/open_webui/config.py:1113 
YOUTUBE_LOADER_LANGUAGE = os.getenv('YOUTUBE_LOADER_LANGUAGE', 'en').split(',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #513b3d9d845d3fa3 — Environment-variable access.
repo/backend/open_webui/config.py:1115 
YOUTUBE_LOADER_PROXY_URL = os.getenv('YOUTUBE_LOADER_PROXY_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53fd879a68ae27e8 — Environment-variable access.
repo/backend/open_webui/config.py:1122 
ENABLE_WEB_SEARCH = os.getenv('ENABLE_WEB_SEARCH', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1f1ca1ba2e1ed88 — Environment-variable access.
repo/backend/open_webui/config.py:1124 
ENABLE_WEB_SEARCH_CONFIRMATION = os.getenv('ENABLE_WEB_SEARCH_CONFIRMATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #27f098d99198219b — Environment-variable access.
repo/backend/open_webui/config.py:1126 
WEB_SEARCH_CONFIRMATION_CONTENT = os.getenv(
    'WEB_SEARCH_CONFIRMATION_CONTENT',
    'Your query will be sent to the configured web search provider.',
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e75292bbb1a7e06 — Environment-variable access.
repo/backend/open_webui/config.py:1131 
WEB_SEARCH_ENGINE = os.getenv('WEB_SEARCH_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #535bd3c3ca47e923 — Environment-variable access.
repo/backend/open_webui/config.py:1134 
    os.getenv('BYPASS_WEB_SEARCH_EMBEDDING_AND_RETRIEVAL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6a1fe5e03e29d6f1 — Environment-variable access.
repo/backend/open_webui/config.py:1138 
BYPASS_WEB_SEARCH_WEB_LOADER = os.getenv('BYPASS_WEB_SEARCH_WEB_LOADER', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2bd5928239ed29ce — Environment-variable access.
repo/backend/open_webui/config.py:1140 
WEB_SEARCH_RESULT_COUNT = int(os.getenv('WEB_SEARCH_RESULT_COUNT', '3'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4052ac33c3295023 — Environment-variable access.
repo/backend/open_webui/config.py:1144 
    web_search_domain_filter_list = json.loads(os.getenv('WEB_SEARCH_DOMAIN_FILTER_LIST', '[]'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f70601c4ca21331d — Environment-variable access.
repo/backend/open_webui/config.py:1157 
WEB_SEARCH_CONCURRENT_REQUESTS = int(os.getenv('WEB_SEARCH_CONCURRENT_REQUESTS', '0'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c5fcfe720b048500 — Environment-variable access.
repo/backend/open_webui/config.py:1160 
    int(os.getenv('WEB_FETCH_MAX_CONTENT_LENGTH')) if os.getenv('WEB_FETCH_MAX_CONTENT_LENGTH') else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #243b1a7ddc685eb4 — Environment-variable access.
repo/backend/open_webui/config.py:1163 
WEB_LOADER_ENGINE = os.getenv('WEB_LOADER_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #323b56cb0ecf4798 — Environment-variable access.
repo/backend/open_webui/config.py:1166 
WEB_LOADER_CONCURRENT_REQUESTS = int(os.getenv('WEB_LOADER_CONCURRENT_REQUESTS', '10'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69e053e971c56369 — Environment-variable access.
repo/backend/open_webui/config.py:1168 
WEB_LOADER_TIMEOUT = os.getenv('WEB_LOADER_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca0153345178716d — Environment-variable access.
repo/backend/open_webui/config.py:1171 
ENABLE_WEB_LOADER_SSL_VERIFICATION = os.getenv('ENABLE_WEB_LOADER_SSL_VERIFICATION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9c24693f518c5150 — Environment-variable access.
repo/backend/open_webui/config.py:1173 
WEB_SEARCH_TRUST_ENV = os.getenv('WEB_SEARCH_TRUST_ENV', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e1f0367aff8b598e — Environment-variable access.
repo/backend/open_webui/config.py:1176 
OLLAMA_CLOUD_WEB_SEARCH_API_KEY = os.getenv('OLLAMA_CLOUD_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fac91516f2044da7 — Environment-variable access.
repo/backend/open_webui/config.py:1178 
SEARXNG_QUERY_URL = os.getenv('SEARXNG_QUERY_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7fb562aad90176ab — Environment-variable access.
repo/backend/open_webui/config.py:1180 
SEARXNG_LANGUAGE = os.getenv('SEARXNG_LANGUAGE', 'all')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a399b791d60837e5 — Environment-variable access.
repo/backend/open_webui/config.py:1182 
YACY_QUERY_URL = os.getenv('YACY_QUERY_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b7173905b3b6dc0 — Environment-variable access.
repo/backend/open_webui/config.py:1184 
YACY_USERNAME = os.getenv('YACY_USERNAME', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d8522a174d055f58 — Environment-variable access.
repo/backend/open_webui/config.py:1186 
YACY_PASSWORD = os.getenv('YACY_PASSWORD', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #047132d2b2a71c74 — Environment-variable access.
repo/backend/open_webui/config.py:1188 
GOOGLE_PSE_API_KEY = os.getenv('GOOGLE_PSE_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0030d2fca7e5197 — Environment-variable access.
repo/backend/open_webui/config.py:1190 
GOOGLE_PSE_ENGINE_ID = os.getenv('GOOGLE_PSE_ENGINE_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a05fe97e999511f9 — Environment-variable access.
repo/backend/open_webui/config.py:1192 
BRAVE_SEARCH_API_KEY = os.getenv('BRAVE_SEARCH_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c58335ee20273f68 — Environment-variable access.
repo/backend/open_webui/config.py:1194 
BRAVE_SEARCH_CONTEXT_TOKENS = int(os.getenv('BRAVE_SEARCH_CONTEXT_TOKENS', '8192'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9aaa5a3ed3a3038 — Environment-variable access.
repo/backend/open_webui/config.py:1196 
KAGI_SEARCH_API_KEY = os.getenv('KAGI_SEARCH_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c270396bfb5b0133 — Environment-variable access.
repo/backend/open_webui/config.py:1198 
MOJEEK_SEARCH_API_KEY = os.getenv('MOJEEK_SEARCH_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #292e988aa0b5a6e4 — Environment-variable access.
repo/backend/open_webui/config.py:1200 
BOCHA_SEARCH_API_KEY = os.getenv('BOCHA_SEARCH_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9c3ad2bc97b0ea88 — Environment-variable access.
repo/backend/open_webui/config.py:1202 
SERPSTACK_API_KEY = os.getenv('SERPSTACK_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db2d5642626659fd — Environment-variable access.
repo/backend/open_webui/config.py:1204 
SERPSTACK_HTTPS = os.getenv('SERPSTACK_HTTPS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ab2e01f445f7b3c — Environment-variable access.
repo/backend/open_webui/config.py:1206 
SERPER_API_KEY = os.getenv('SERPER_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0644decffaac45bc — Environment-variable access.
repo/backend/open_webui/config.py:1208 
SERPLY_API_KEY = os.getenv('SERPLY_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2e55829f779c98a — Environment-variable access.
repo/backend/open_webui/config.py:1210 
SERPHOUSE_API_KEY = os.getenv('SERPHOUSE_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a71db2e889f272a — Environment-variable access.
repo/backend/open_webui/config.py:1212 
SERPHOUSE_DOMAIN = os.getenv('SERPHOUSE_DOMAIN', 'google.com')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ade8635b3324ae9b — Environment-variable access.
repo/backend/open_webui/config.py:1214 
DDGS_BACKEND = os.getenv('DDGS_BACKEND', 'auto')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6d8b35448271abc9 — Environment-variable access.
repo/backend/open_webui/config.py:1216 
JINA_API_KEY = os.getenv('JINA_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f34046e83674e107 — Environment-variable access.
repo/backend/open_webui/config.py:1218 
JINA_API_BASE_URL = os.getenv('JINA_API_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #754793749dd249e6 — Environment-variable access.
repo/backend/open_webui/config.py:1220 
SEARCHAPI_API_KEY = os.getenv('SEARCHAPI_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #29668521ea92d27e — Environment-variable access.
repo/backend/open_webui/config.py:1222 
SEARCHAPI_ENGINE = os.getenv('SEARCHAPI_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da4e83a06eaa1a6b — Environment-variable access.
repo/backend/open_webui/config.py:1224 
SERPAPI_API_KEY = os.getenv('SERPAPI_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca7f344c5e572a5b — Environment-variable access.
repo/backend/open_webui/config.py:1226 
SERPAPI_ENGINE = os.getenv('SERPAPI_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6721c4e508e823d9 — Environment-variable access.
repo/backend/open_webui/config.py:1228 
BING_SEARCH_V7_ENDPOINT = os.getenv('BING_SEARCH_V7_ENDPOINT', 'https://api.bing.microsoft.com/v7.0/search')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e9168c2e02f974e — Environment-variable access.
repo/backend/open_webui/config.py:1230 
BING_SEARCH_V7_SUBSCRIPTION_KEY = os.getenv('BING_SEARCH_V7_SUBSCRIPTION_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #31a347368b968e0a — Environment-variable access.
repo/backend/open_webui/config.py:1232 
AZURE_AI_SEARCH_API_KEY = os.getenv('AZURE_AI_SEARCH_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #768fdf10ed0e6d03 — Environment-variable access.
repo/backend/open_webui/config.py:1234 
AZURE_AI_SEARCH_ENDPOINT = os.getenv('AZURE_AI_SEARCH_ENDPOINT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7d1bca7c5a3288d — Environment-variable access.
repo/backend/open_webui/config.py:1236 
AZURE_AI_SEARCH_INDEX_NAME = os.getenv('AZURE_AI_SEARCH_INDEX_NAME', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #481df2fe25fbdb0b — Environment-variable access.
repo/backend/open_webui/config.py:1238 
EXA_API_KEY = os.getenv('EXA_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54462cad92375f78 — Environment-variable access.
repo/backend/open_webui/config.py:1240 
PERPLEXITY_API_KEY = os.getenv('PERPLEXITY_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d296bc676df57a4 — Environment-variable access.
repo/backend/open_webui/config.py:1242 
PERPLEXITY_MODEL = os.getenv('PERPLEXITY_MODEL', 'sonar')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #692bffe17b7478e2 — Environment-variable access.
repo/backend/open_webui/config.py:1244 
PERPLEXITY_SEARCH_CONTEXT_USAGE = os.getenv('PERPLEXITY_SEARCH_CONTEXT_USAGE', 'medium')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb4b48205c5c1768 — Environment-variable access.
repo/backend/open_webui/config.py:1246 
PERPLEXITY_SEARCH_API_URL = os.getenv('PERPLEXITY_SEARCH_API_URL', 'https://api.perplexity.ai/search')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4751150bbc5547b8 — Environment-variable access.
repo/backend/open_webui/config.py:1248 
MICROSOFT_WEB_IQ_API_BASE_URL = os.getenv('MICROSOFT_WEB_IQ_API_BASE_URL', 'https://api.microsoft.ai/v3')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a897ed79146a79ec — Environment-variable access.
repo/backend/open_webui/config.py:1250 
MICROSOFT_WEB_IQ_API_KEY = os.getenv('MICROSOFT_WEB_IQ_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8047733645bc3efb — Environment-variable access.
repo/backend/open_webui/config.py:1252 
MICROSOFT_WEB_IQ_LANGUAGE = os.getenv('MICROSOFT_WEB_IQ_LANGUAGE', 'en')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32ad4c895bc5a0a3 — Environment-variable access.
repo/backend/open_webui/config.py:1254 
SOUGOU_API_SID = os.getenv('SOUGOU_API_SID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6601465fbc2d4e2f — Environment-variable access.
repo/backend/open_webui/config.py:1256 
SOUGOU_API_SK = os.getenv('SOUGOU_API_SK', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6f72d143b0712b30 — Environment-variable access.
repo/backend/open_webui/config.py:1258 
TAVILY_API_KEY = os.getenv('TAVILY_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #852802b2f57552c3 — Environment-variable access.
repo/backend/open_webui/config.py:1260 
TAVILY_EXTRACT_DEPTH = os.getenv('TAVILY_EXTRACT_DEPTH', 'basic')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0fab22125e221dba — Environment-variable access.
repo/backend/open_webui/config.py:1262 
PLAYWRIGHT_WS_URL = os.getenv('PLAYWRIGHT_WS_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e72d3a5956aaeeb7 — Environment-variable access.
repo/backend/open_webui/config.py:1264 
PLAYWRIGHT_TIMEOUT = int(os.getenv('PLAYWRIGHT_TIMEOUT', '10000'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d76c05e7c48d3ae0 — Environment-variable access.
repo/backend/open_webui/config.py:1266 
FIRECRAWL_API_KEY = os.getenv('FIRECRAWL_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4fd38f1d6f44efc9 — Environment-variable access.
repo/backend/open_webui/config.py:1268 
FIRECRAWL_API_BASE_URL = os.getenv('FIRECRAWL_API_BASE_URL', 'https://api.firecrawl.dev')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e23a243e9c295043 — Environment-variable access.
repo/backend/open_webui/config.py:1270 
FIRECRAWL_TIMEOUT = os.getenv('FIRECRAWL_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83c848c9e57d7874 — Environment-variable access.
repo/backend/open_webui/config.py:1272 
EXTERNAL_WEB_SEARCH_URL = os.getenv('EXTERNAL_WEB_SEARCH_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #16548c047f819a98 — Environment-variable access.
repo/backend/open_webui/config.py:1274 
EXTERNAL_WEB_SEARCH_API_KEY = os.getenv('EXTERNAL_WEB_SEARCH_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f003bff2e7fe3664 — Environment-variable access.
repo/backend/open_webui/config.py:1276 
EXTERNAL_WEB_LOADER_URL = os.getenv('EXTERNAL_WEB_LOADER_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #47d7150c64dcd557 — Environment-variable access.
repo/backend/open_webui/config.py:1278 
EXTERNAL_WEB_LOADER_API_KEY = os.getenv('EXTERNAL_WEB_LOADER_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4206f297149030ec — Environment-variable access.
repo/backend/open_webui/config.py:1280 
YANDEX_WEB_SEARCH_URL = os.getenv('YANDEX_WEB_SEARCH_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c93af0e7aa1e1846 — Environment-variable access.
repo/backend/open_webui/config.py:1282 
YANDEX_WEB_SEARCH_API_KEY = os.getenv('YANDEX_WEB_SEARCH_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b0d8eb775523991 — Environment-variable access.
repo/backend/open_webui/config.py:1284 
YANDEX_WEB_SEARCH_CONFIG = os.getenv('YANDEX_WEB_SEARCH_CONFIG', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3c650e549c9e6c57 — Environment-variable access.
repo/backend/open_webui/config.py:1286 
YOUCOM_API_KEY = os.getenv('YOUCOM_API_KEY', os.getenv('YDC_API_KEY', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f99c3dd5100af7aa — Environment-variable access.
repo/backend/open_webui/config.py:1288 
LINKUP_API_KEY = os.getenv('LINKUP_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b872a54aeaaf1bb — Environment-variable access.
repo/backend/open_webui/config.py:1290 
linkup_search_params = os.getenv('LINKUP_SEARCH_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d091e5e67d265236 — Environment-variable access.
repo/backend/open_webui/config.py:1302 
ENABLE_IMAGE_GENERATION = os.getenv('ENABLE_IMAGE_GENERATION', '').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bfe73d96b71a1179 — Environment-variable access.
repo/backend/open_webui/config.py:1304 
IMAGE_GENERATION_ENGINE = os.getenv('IMAGE_GENERATION_ENGINE', 'openai')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #70f20f533ce02fe3 — Environment-variable access.
repo/backend/open_webui/config.py:1306 
IMAGE_GENERATION_MODEL = os.getenv('IMAGE_GENERATION_MODEL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b6ca950784710ea — Environment-variable access.
repo/backend/open_webui/config.py:1309 
IMAGE_AUTO_SIZE_MODELS_REGEX_PATTERN = os.getenv('IMAGE_AUTO_SIZE_MODELS_REGEX_PATTERN', '^gpt-image')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9513bc44a56215b6 — Environment-variable access.
repo/backend/open_webui/config.py:1312 
IMAGE_URL_RESPONSE_MODELS_REGEX_PATTERN = os.getenv('IMAGE_URL_RESPONSE_MODELS_REGEX_PATTERN', '^gpt-image')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c43c1ce77c4327e — Environment-variable access.
repo/backend/open_webui/config.py:1314 
IMAGE_SIZE = os.getenv('IMAGE_SIZE', '512x512')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39e8dfa7b5541318 — Environment-variable access.
repo/backend/open_webui/config.py:1316 
IMAGE_STEPS = int(os.getenv('IMAGE_STEPS', 50))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a3fe8e00dc704de — Environment-variable access.
repo/backend/open_webui/config.py:1318 
ENABLE_IMAGE_PROMPT_GENERATION = os.getenv('ENABLE_IMAGE_PROMPT_GENERATION', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bca52a4c2bd6ec66 — Environment-variable access.
repo/backend/open_webui/config.py:1320 
AUTOMATIC1111_BASE_URL = os.getenv('AUTOMATIC1111_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f93a50a837308b85 — Environment-variable access.
repo/backend/open_webui/config.py:1321 
AUTOMATIC1111_API_AUTH = os.getenv('AUTOMATIC1111_API_AUTH', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e96be56d432c5dd6 — Environment-variable access.
repo/backend/open_webui/config.py:1323 
automatic1111_params = os.getenv('AUTOMATIC1111_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f58694c30e1ae726 — Environment-variable access.
repo/backend/open_webui/config.py:1331 
COMFYUI_BASE_URL = os.getenv('COMFYUI_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8a7977259530221f — Environment-variable access.
repo/backend/open_webui/config.py:1333 
COMFYUI_API_KEY = os.getenv('COMFYUI_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bfc47cbf7060ce9e — Environment-variable access.
repo/backend/open_webui/config.py:1446 
COMFYUI_WORKFLOW = os.getenv('COMFYUI_WORKFLOW', COMFYUI_DEFAULT_WORKFLOW)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac84480fad2268da — Environment-variable access.
repo/backend/open_webui/config.py:1448 
comfyui_workflow_nodes = os.getenv('COMFYUI_WORKFLOW_NODES', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d84e3927d1fb837a — Environment-variable access.
repo/backend/open_webui/config.py:1456 
IMAGES_OPENAI_API_BASE_URL = os.getenv('IMAGES_OPENAI_API_BASE_URL', OPENAI_API_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #249cc0e593f47acf — Environment-variable access.
repo/backend/open_webui/config.py:1457 
IMAGES_OPENAI_API_VERSION = os.getenv('IMAGES_OPENAI_API_VERSION', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #68cc7423983233c3 — Environment-variable access.
repo/backend/open_webui/config.py:1459 
IMAGES_OPENAI_API_KEY = os.getenv('IMAGES_OPENAI_API_KEY', OPENAI_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #add9496dc97da4cc — Environment-variable access.
repo/backend/open_webui/config.py:1461 
images_openai_params = os.getenv('IMAGES_OPENAI_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9cb719dd9c9e9a91 — Environment-variable access.
repo/backend/open_webui/config.py:1471 
IMAGES_GEMINI_API_BASE_URL = os.getenv('IMAGES_GEMINI_API_BASE_URL', GEMINI_API_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e92f36e5e4669b31 — Environment-variable access.
repo/backend/open_webui/config.py:1472 
IMAGES_GEMINI_API_KEY = os.getenv('IMAGES_GEMINI_API_KEY', GEMINI_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #81063daeccb72880 — Environment-variable access.
repo/backend/open_webui/config.py:1474 
IMAGES_GEMINI_ENDPOINT_METHOD = os.getenv('IMAGES_GEMINI_ENDPOINT_METHOD', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ac42f96e0296652 — Environment-variable access.
repo/backend/open_webui/config.py:1476 
ENABLE_IMAGE_EDIT = os.getenv('ENABLE_IMAGE_EDIT', '').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #59bd6bc94315d62a — Environment-variable access.
repo/backend/open_webui/config.py:1478 
IMAGE_EDIT_ENGINE = os.getenv('IMAGE_EDIT_ENGINE', 'openai')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ea69d025a2db189 — Environment-variable access.
repo/backend/open_webui/config.py:1480 
IMAGE_EDIT_MODEL = os.getenv('IMAGE_EDIT_MODEL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bf2c88a3c45be2e0 — Environment-variable access.
repo/backend/open_webui/config.py:1482 
IMAGE_EDIT_SIZE = os.getenv('IMAGE_EDIT_SIZE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #313a328e55bc0ba1 — Environment-variable access.
repo/backend/open_webui/config.py:1484 
ENABLE_OPENAI_IMAGE_EDIT_NORMALIZATION = os.getenv('ENABLE_OPENAI_IMAGE_EDIT_NORMALIZATION', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc38d920cd0cd439 — Environment-variable access.
repo/backend/open_webui/config.py:1486 
IMAGES_EDIT_OPENAI_API_BASE_URL = os.getenv('IMAGES_EDIT_OPENAI_API_BASE_URL', OPENAI_API_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c1897a4bba22be5 — Environment-variable access.
repo/backend/open_webui/config.py:1487 
IMAGES_EDIT_OPENAI_API_VERSION = os.getenv('IMAGES_EDIT_OPENAI_API_VERSION', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aeefa97307bcce8d — Environment-variable access.
repo/backend/open_webui/config.py:1489 
IMAGES_EDIT_OPENAI_API_KEY = os.getenv('IMAGES_EDIT_OPENAI_API_KEY', OPENAI_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e39122a4bddb9a9 — Environment-variable access.
repo/backend/open_webui/config.py:1491 
IMAGES_EDIT_GEMINI_API_BASE_URL = os.getenv('IMAGES_EDIT_GEMINI_API_BASE_URL', GEMINI_API_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #63b2172b038a3420 — Environment-variable access.
repo/backend/open_webui/config.py:1492 
IMAGES_EDIT_GEMINI_API_KEY = os.getenv('IMAGES_EDIT_GEMINI_API_KEY', GEMINI_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d55c1c536d22ca20 — Environment-variable access.
repo/backend/open_webui/config.py:1495 
IMAGES_EDIT_COMFYUI_BASE_URL = os.getenv('IMAGES_EDIT_COMFYUI_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4332a6e4b8f5fd17 — Environment-variable access.
repo/backend/open_webui/config.py:1496 
IMAGES_EDIT_COMFYUI_API_KEY = os.getenv('IMAGES_EDIT_COMFYUI_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4706794709336163 — Environment-variable access.
repo/backend/open_webui/config.py:1498 
IMAGES_EDIT_COMFYUI_WORKFLOW = os.getenv('IMAGES_EDIT_COMFYUI_WORKFLOW', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #55393690aa6427b1 — Environment-variable access.
repo/backend/open_webui/config.py:1500 
images_edit_comfyui_workflow_nodes = os.getenv('IMAGES_EDIT_COMFYUI_WORKFLOW_NODES', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2a3187122ce210c — Environment-variable access.
repo/backend/open_webui/config.py:1513 
WHISPER_MODEL = os.getenv('WHISPER_MODEL', 'base')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6ac20be6d0da6892 — Environment-variable access.
repo/backend/open_webui/config.py:1515 
WHISPER_COMPUTE_TYPE = os.getenv('WHISPER_COMPUTE_TYPE', 'int8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #58e674e059561c5a — Environment-variable access.
repo/backend/open_webui/config.py:1516 
WHISPER_MODEL_DIR = os.getenv('WHISPER_MODEL_DIR', f'{CACHE_DIR}/whisper/models')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5651e182b42eb134 — Environment-variable access.
repo/backend/open_webui/config.py:1517 
WHISPER_MODEL_AUTO_UPDATE = not OFFLINE_MODE and os.getenv('WHISPER_MODEL_AUTO_UPDATE', '').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f16f1c5f02af80c9 — Environment-variable access.
repo/backend/open_webui/config.py:1519 
WHISPER_VAD_FILTER = os.getenv('WHISPER_VAD_FILTER', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a26375794e48852 — Environment-variable access.
repo/backend/open_webui/config.py:1521 
WHISPER_MULTILINGUAL = os.getenv('WHISPER_MULTILINGUAL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #08646761fecd2395 — Environment-variable access.
repo/backend/open_webui/config.py:1523 
WHISPER_LANGUAGE = os.getenv('WHISPER_LANGUAGE', '').lower() or None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #207d64a8034d0d16 — Environment-variable access.
repo/backend/open_webui/config.py:1526 
DEEPGRAM_API_KEY = os.getenv('DEEPGRAM_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6cecbe95b7d821ef — Environment-variable access.
repo/backend/open_webui/config.py:1529 
ELEVENLABS_API_BASE_URL = os.getenv('ELEVENLABS_API_BASE_URL', 'https://api.elevenlabs.io')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8166b2eb8ee58bc6 — Environment-variable access.
repo/backend/open_webui/config.py:1531 
AUDIO_STT_OPENAI_API_BASE_URL = os.getenv('AUDIO_STT_OPENAI_API_BASE_URL', OPENAI_API_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad840fac70519048 — Environment-variable access.
repo/backend/open_webui/config.py:1533 
AUDIO_STT_OPENAI_API_KEY = os.getenv('AUDIO_STT_OPENAI_API_KEY', OPENAI_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #812aba0d7cefe313 — Environment-variable access.
repo/backend/open_webui/config.py:1535 
AUDIO_STT_OPENAI_API_REQUEST_FORMAT = os.getenv('AUDIO_STT_OPENAI_API_REQUEST_FORMAT', 'multipart')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1483f0a40ddde0f8 — Environment-variable access.
repo/backend/open_webui/config.py:1537 
AUDIO_STT_ENGINE = os.getenv('AUDIO_STT_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #704f31caa47590dc — Environment-variable access.
repo/backend/open_webui/config.py:1539 
AUDIO_STT_MODEL = os.getenv('AUDIO_STT_MODEL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ecf91a8f34fd028 — Environment-variable access.
repo/backend/open_webui/config.py:1543 
    for content_type in os.getenv('AUDIO_STT_SUPPORTED_CONTENT_TYPES', '').split(',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2e0b1ff7cc22a97c — Environment-variable access.
repo/backend/open_webui/config.py:1549 
    for ext in os.getenv(
        'AUDIO_STT_ALLOWED_EXTENSIONS',
        'mp3,wav,m4a,webm,ogg,flac,mp4,mpga,mpeg',
    ).split(',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e8ab31d50356fb60 — Environment-variable access.
repo/backend/open_webui/config.py:1556 
AUDIO_STT_AZURE_API_KEY = os.getenv('AUDIO_STT_AZURE_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #152e7523e83c0a12 — Environment-variable access.
repo/backend/open_webui/config.py:1558 
AUDIO_STT_AZURE_REGION = os.getenv('AUDIO_STT_AZURE_REGION', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3be055b318c72b35 — Environment-variable access.
repo/backend/open_webui/config.py:1560 
AUDIO_STT_AZURE_LOCALES = os.getenv('AUDIO_STT_AZURE_LOCALES', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #674470b8f80e9971 — Environment-variable access.
repo/backend/open_webui/config.py:1562 
AUDIO_STT_AZURE_BASE_URL = os.getenv('AUDIO_STT_AZURE_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4c5d35165de89c90 — Environment-variable access.
repo/backend/open_webui/config.py:1564 
AUDIO_STT_AZURE_MAX_SPEAKERS = os.getenv('AUDIO_STT_AZURE_MAX_SPEAKERS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #833e94b47a44d5d3 — Environment-variable access.
repo/backend/open_webui/config.py:1566 
AUDIO_STT_MISTRAL_API_KEY = os.getenv('AUDIO_STT_MISTRAL_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9545811c26e8fde — Environment-variable access.
repo/backend/open_webui/config.py:1568 
AUDIO_STT_MISTRAL_API_BASE_URL = os.getenv('AUDIO_STT_MISTRAL_API_BASE_URL', 'https://api.mistral.ai/v1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a7aa043acc41153 — Environment-variable access.
repo/backend/open_webui/config.py:1570 
AUDIO_STT_MISTRAL_USE_CHAT_COMPLETIONS = os.getenv('AUDIO_STT_MISTRAL_USE_CHAT_COMPLETIONS', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #75880bbec2e412f3 — Environment-variable access.
repo/backend/open_webui/config.py:1572 
AUDIO_TTS_OPENAI_API_BASE_URL = os.getenv('AUDIO_TTS_OPENAI_API_BASE_URL', OPENAI_API_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6877d0c8fa8278a7 — Environment-variable access.
repo/backend/open_webui/config.py:1573 
AUDIO_TTS_OPENAI_API_KEY = os.getenv('AUDIO_TTS_OPENAI_API_KEY', OPENAI_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #497f00846a57cd08 — Environment-variable access.
repo/backend/open_webui/config.py:1575 
audio_tts_openai_params = os.getenv('AUDIO_TTS_OPENAI_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a0ed7f52074df1b — Environment-variable access.
repo/backend/open_webui/config.py:1584 
AUDIO_TTS_API_KEY = os.getenv('AUDIO_TTS_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #343e1e1f63cc786f — Environment-variable access.
repo/backend/open_webui/config.py:1586 
AUDIO_TTS_ENGINE = os.getenv('AUDIO_TTS_ENGINE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3cecee9d99161fd4 — Environment-variable access.
repo/backend/open_webui/config.py:1589 
AUDIO_TTS_MODEL = os.getenv('AUDIO_TTS_MODEL', 'tts-1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9bfe4cdc45bc0cfc — Environment-variable access.
repo/backend/open_webui/config.py:1591 
AUDIO_TTS_VOICE = os.getenv('AUDIO_TTS_VOICE', 'alloy')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b44193df572c5f01 — Environment-variable access.
repo/backend/open_webui/config.py:1593 
AUDIO_TTS_SPLIT_ON = os.getenv('AUDIO_TTS_SPLIT_ON', 'punctuation')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aac581683754aa91 — Environment-variable access.
repo/backend/open_webui/config.py:1595 
AUDIO_TTS_AZURE_SPEECH_REGION = os.getenv('AUDIO_TTS_AZURE_SPEECH_REGION', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4c39fc678d5ab13 — Environment-variable access.
repo/backend/open_webui/config.py:1597 
AUDIO_TTS_AZURE_SPEECH_BASE_URL = os.getenv('AUDIO_TTS_AZURE_SPEECH_BASE_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f485f638c1654e06 — Environment-variable access.
repo/backend/open_webui/config.py:1599 
AUDIO_TTS_AZURE_SPEECH_OUTPUT_FORMAT = os.getenv(
    'AUDIO_TTS_AZURE_SPEECH_OUTPUT_FORMAT', 'audio-24khz-160kbitrate-mono-mp3'
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2389adc8e3c87285 — Environment-variable access.
repo/backend/open_webui/config.py:1603 
AUDIO_TTS_MISTRAL_API_KEY = os.getenv('AUDIO_TTS_MISTRAL_API_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8fb5d756949eeb87 — Environment-variable access.
repo/backend/open_webui/config.py:1605 
AUDIO_TTS_MISTRAL_API_BASE_URL = os.getenv('AUDIO_TTS_MISTRAL_API_BASE_URL', 'https://api.mistral.ai/v1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #204f8d385a292af4 — Environment-variable access.
repo/backend/open_webui/config.py:1612 
WEBUI_URL = os.getenv('WEBUI_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ea45c958bbaac002 — Environment-variable access.
repo/backend/open_webui/config.py:1615 
ENABLE_SIGNUP = False if not WEBUI_AUTH else os.getenv('ENABLE_SIGNUP', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99a0e0069c5ace8f — Environment-variable access.
repo/backend/open_webui/config.py:1617 
ENABLE_LOGIN_FORM = os.getenv('ENABLE_LOGIN_FORM', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7e010a955e83fb45 — Environment-variable access.
repo/backend/open_webui/config.py:1619 
ENABLE_PASSWORD_CHANGE_FORM = os.getenv('ENABLE_PASSWORD_CHANGE_FORM', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #86b8bf678be6396b — Environment-variable access.
repo/backend/open_webui/config.py:1621 
ENABLE_PASSWORD_AUTH = os.getenv('ENABLE_PASSWORD_AUTH', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b35f5165332a1977 — Environment-variable access.
repo/backend/open_webui/config.py:1623 
DEFAULT_LOCALE = os.getenv('DEFAULT_LOCALE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b57ff975ada06314 — Environment-variable access.
repo/backend/open_webui/config.py:1625 
DEFAULT_MODELS = os.getenv('DEFAULT_MODELS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9f74225f0e85b2e5 — Environment-variable access.
repo/backend/open_webui/config.py:1627 
DEFAULT_PINNED_MODELS = os.getenv('DEFAULT_PINNED_MODELS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3dd12889be97d850 — Environment-variable access.
repo/backend/open_webui/config.py:1630 
    default_prompt_suggestions = json.loads(os.getenv('DEFAULT_PROMPT_SUGGESTIONS', '[]'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #26e9b43bcbbfb408 — Environment-variable access.
repo/backend/open_webui/config.py:1670 
    default_model_metadata = json.loads(os.getenv('DEFAULT_MODEL_METADATA', '{}'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dcd56505ace5071c — Environment-variable access.
repo/backend/open_webui/config.py:1678 
    default_model_params = json.loads(os.getenv('DEFAULT_MODEL_PARAMS', '{}'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b533eb514aa49ce9 — Environment-variable access.
repo/backend/open_webui/config.py:1685 
DEFAULT_USER_ROLE = os.getenv('DEFAULT_USER_ROLE', 'pending')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2f463e4ce6cf5fb — Environment-variable access.
repo/backend/open_webui/config.py:1687 
DEFAULT_GROUP_ID = os.getenv('DEFAULT_GROUP_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97ae027d05115254 — Environment-variable access.
repo/backend/open_webui/config.py:1689 
PENDING_USER_OVERLAY_TITLE = os.getenv('PENDING_USER_OVERLAY_TITLE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #35553e7e569cfdce — Environment-variable access.
repo/backend/open_webui/config.py:1691 
PENDING_USER_OVERLAY_CONTENT = os.getenv('PENDING_USER_OVERLAY_CONTENT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #431ad9fcd0f27fe8 — Environment-variable access.
repo/backend/open_webui/config.py:1694 
RESPONSE_WATERMARK = os.getenv('RESPONSE_WATERMARK', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #00cf02edb61b3366 — Environment-variable access.
repo/backend/open_webui/config.py:1696 
IFRAME_CSP = os.getenv('IFRAME_CSP', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7f5ded571d1476f — Environment-variable access.
repo/backend/open_webui/config.py:1699 
    os.getenv('USER_PERMISSIONS_WORKSPACE_MODELS_ACCESS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5716ab76d8e98499 — Environment-variable access.
repo/backend/open_webui/config.py:1703 
    os.getenv('USER_PERMISSIONS_WORKSPACE_KNOWLEDGE_ACCESS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ead665a01cd04da — Environment-variable access.
repo/backend/open_webui/config.py:1707 
    os.getenv('USER_PERMISSIONS_WORKSPACE_PROMPTS_ACCESS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53ffff0e4bb92763 — Environment-variable access.
repo/backend/open_webui/config.py:1711 
    os.getenv('USER_PERMISSIONS_WORKSPACE_TOOLS_ACCESS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9ed369aa44dc4c0a — Environment-variable access.
repo/backend/open_webui/config.py:1715 
    os.getenv('USER_PERMISSIONS_WORKSPACE_SKILLS_ACCESS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45df6038c4779280 — Environment-variable access.
repo/backend/open_webui/config.py:1719 
    os.getenv('USER_PERMISSIONS_WORKSPACE_MODELS_IMPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b3623383cc8be699 — Environment-variable access.
repo/backend/open_webui/config.py:1723 
    os.getenv('USER_PERMISSIONS_WORKSPACE_MODELS_EXPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef56f33dc1d27a2f — Environment-variable access.
repo/backend/open_webui/config.py:1727 
    os.getenv('USER_PERMISSIONS_WORKSPACE_PROMPTS_IMPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6319aec3bb792370 — Environment-variable access.
repo/backend/open_webui/config.py:1731 
    os.getenv('USER_PERMISSIONS_WORKSPACE_PROMPTS_EXPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dfc07d19864aa695 — Environment-variable access.
repo/backend/open_webui/config.py:1735 
    os.getenv('USER_PERMISSIONS_WORKSPACE_TOOLS_IMPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c28881c959e7501b — Environment-variable access.
repo/backend/open_webui/config.py:1739 
    os.getenv('USER_PERMISSIONS_WORKSPACE_TOOLS_EXPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc379c50f6b3138a — Environment-variable access.
repo/backend/open_webui/config.py:1743 
    os.getenv('USER_PERMISSIONS_WORKSPACE_SKILLS_IMPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c1bcdbcd1b8d9ac — Environment-variable access.
repo/backend/open_webui/config.py:1747 
    os.getenv('USER_PERMISSIONS_WORKSPACE_SKILLS_EXPORT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f758418229d7f793 — Environment-variable access.
repo/backend/open_webui/config.py:1752 
    os.getenv('USER_PERMISSIONS_WORKSPACE_MODELS_ALLOW_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4b88d00c15e26a4e — Environment-variable access.
repo/backend/open_webui/config.py:1756 
    os.getenv('USER_PERMISSIONS_WORKSPACE_MODELS_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e92cad7438b08326 — Environment-variable access.
repo/backend/open_webui/config.py:1760 
    os.getenv('USER_PERMISSIONS_WORKSPACE_KNOWLEDGE_ALLOW_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #46ebba8b406ceba6 — Environment-variable access.
repo/backend/open_webui/config.py:1764 
    os.getenv('USER_PERMISSIONS_WORKSPACE_KNOWLEDGE_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a4b3eb169a7c788 — Environment-variable access.
repo/backend/open_webui/config.py:1768 
    os.getenv('USER_PERMISSIONS_WORKSPACE_PROMPTS_ALLOW_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64c61dbea27e8509 — Environment-variable access.
repo/backend/open_webui/config.py:1772 
    os.getenv('USER_PERMISSIONS_WORKSPACE_PROMPTS_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #17310a4c7c2c6ca0 — Environment-variable access.
repo/backend/open_webui/config.py:1777 
    os.getenv('USER_PERMISSIONS_WORKSPACE_TOOLS_ALLOW_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0d225bb45558625 — Environment-variable access.
repo/backend/open_webui/config.py:1781 
    os.getenv('USER_PERMISSIONS_WORKSPACE_TOOLS_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9301307e2c5d59e5 — Environment-variable access.
repo/backend/open_webui/config.py:1785 
    os.getenv('USER_PERMISSIONS_WORKSPACE_SKILLS_ALLOW_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #acf37984935d952e — Environment-variable access.
repo/backend/open_webui/config.py:1789 
    os.getenv('USER_PERMISSIONS_WORKSPACE_SKILLS_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0954ec037232a0ad — Environment-variable access.
repo/backend/open_webui/config.py:1793 
USER_PERMISSIONS_NOTES_ALLOW_SHARING = os.getenv('USER_PERMISSIONS_NOTES_ALLOW_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #702f8a87f2ff20a1 — Environment-variable access.
repo/backend/open_webui/config.py:1796 
    os.getenv('USER_PERMISSIONS_NOTES_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a3058f555d83e7b — Environment-variable access.
repo/backend/open_webui/config.py:1799 
USER_PERMISSIONS_FOLDERS_ALLOW_SHARING = os.getenv('USER_PERMISSIONS_FOLDERS_ALLOW_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #174b752a5f5d63ed — Environment-variable access.
repo/backend/open_webui/config.py:1803 
    os.getenv('USER_PERMISSIONS_CALENDAR_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a0827d53aac8013 — Environment-variable access.
repo/backend/open_webui/config.py:1807 
    os.getenv('USER_PERMISSIONS_ACCESS_GRANTS_ALLOW_USERS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5830a872e6789473 — Environment-variable access.
repo/backend/open_webui/config.py:1811 
USER_PERMISSIONS_CHAT_CONTROLS = os.getenv('USER_PERMISSIONS_CHAT_CONTROLS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b67905d203c6aced — Environment-variable access.
repo/backend/open_webui/config.py:1813 
USER_PERMISSIONS_CHAT_VALVES = os.getenv('USER_PERMISSIONS_CHAT_VALVES', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a2680bffc7911106 — Environment-variable access.
repo/backend/open_webui/config.py:1815 
USER_PERMISSIONS_CHAT_SYSTEM_PROMPT = os.getenv('USER_PERMISSIONS_CHAT_SYSTEM_PROMPT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eddc9d7c5426e6f2 — Environment-variable access.
repo/backend/open_webui/config.py:1817 
USER_PERMISSIONS_CHAT_PARAMS = os.getenv('USER_PERMISSIONS_CHAT_PARAMS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a1133a18d3d2d606 — Environment-variable access.
repo/backend/open_webui/config.py:1819 
USER_PERMISSIONS_CHAT_FILE_UPLOAD = os.getenv('USER_PERMISSIONS_CHAT_FILE_UPLOAD', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #784927f417c05d27 — Environment-variable access.
repo/backend/open_webui/config.py:1821 
USER_PERMISSIONS_CHAT_WEB_UPLOAD = os.getenv('USER_PERMISSIONS_CHAT_WEB_UPLOAD', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0f046afe76f5cb2 — Environment-variable access.
repo/backend/open_webui/config.py:1823 
USER_PERMISSIONS_CHAT_DELETE = os.getenv('USER_PERMISSIONS_CHAT_DELETE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c419cdbb4144a898 — Environment-variable access.
repo/backend/open_webui/config.py:1825 
USER_PERMISSIONS_CHAT_DELETE_MESSAGE = os.getenv('USER_PERMISSIONS_CHAT_DELETE_MESSAGE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #60aa9af3532dca58 — Environment-variable access.
repo/backend/open_webui/config.py:1827 
USER_PERMISSIONS_CHAT_CONTINUE_RESPONSE = os.getenv('USER_PERMISSIONS_CHAT_CONTINUE_RESPONSE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #95a0d245524c688c — Environment-variable access.
repo/backend/open_webui/config.py:1830 
    os.getenv('USER_PERMISSIONS_CHAT_REGENERATE_RESPONSE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4b528056ddf90cd — Environment-variable access.
repo/backend/open_webui/config.py:1833 
USER_PERMISSIONS_CHAT_RATE_RESPONSE = os.getenv('USER_PERMISSIONS_CHAT_RATE_RESPONSE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9f83be9782e63a4a — Environment-variable access.
repo/backend/open_webui/config.py:1835 
USER_PERMISSIONS_CHAT_EDIT = os.getenv('USER_PERMISSIONS_CHAT_EDIT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d95a7d6eba759b2 — Environment-variable access.
repo/backend/open_webui/config.py:1837 
USER_PERMISSIONS_CHAT_SHARE = os.getenv('USER_PERMISSIONS_CHAT_SHARE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #708be04a27430037 — Environment-variable access.
repo/backend/open_webui/config.py:1840 
    os.getenv('USER_PERMISSIONS_CHAT_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f7986d640d2f7c65 — Environment-variable access.
repo/backend/open_webui/config.py:1843 
USER_PERMISSIONS_CHAT_EXPORT = os.getenv('USER_PERMISSIONS_CHAT_EXPORT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #17edc770680a14f5 — Environment-variable access.
repo/backend/open_webui/config.py:1845 
USER_PERMISSIONS_CHAT_IMPORT = os.getenv('USER_PERMISSIONS_CHAT_IMPORT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c6c92a91be1fc0d — Environment-variable access.
repo/backend/open_webui/config.py:1847 
USER_PERMISSIONS_CHAT_STT = os.getenv('USER_PERMISSIONS_CHAT_STT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40d81725dd539aff — Environment-variable access.
repo/backend/open_webui/config.py:1849 
USER_PERMISSIONS_CHAT_TTS = os.getenv('USER_PERMISSIONS_CHAT_TTS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #863aa5a5b7b13d3d — Environment-variable access.
repo/backend/open_webui/config.py:1851 
USER_PERMISSIONS_CHAT_CALL = os.getenv('USER_PERMISSIONS_CHAT_CALL', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b3aa8941bbc64c82 — Environment-variable access.
repo/backend/open_webui/config.py:1853 
USER_PERMISSIONS_CHAT_MULTIPLE_MODELS = os.getenv('USER_PERMISSIONS_CHAT_MULTIPLE_MODELS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #01b6273183fc31e3 — Environment-variable access.
repo/backend/open_webui/config.py:1855 
USER_PERMISSIONS_CHAT_TEMPORARY = os.getenv('USER_PERMISSIONS_CHAT_TEMPORARY', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #44f3496fa3781095 — Environment-variable access.
repo/backend/open_webui/config.py:1858 
    os.getenv('USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7adc7ed41c8971ba — Environment-variable access.
repo/backend/open_webui/config.py:1863 
    os.getenv('USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #04f298691f6c2f30 — Environment-variable access.
repo/backend/open_webui/config.py:1866 
USER_PERMISSIONS_FEATURES_WEB_SEARCH = os.getenv('USER_PERMISSIONS_FEATURES_WEB_SEARCH', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f102937c5587902 — Environment-variable access.
repo/backend/open_webui/config.py:1869 
    os.getenv('USER_PERMISSIONS_FEATURES_IMAGE_GENERATION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f51465c5cf1ec32 — Environment-variable access.
repo/backend/open_webui/config.py:1873 
    os.getenv('USER_PERMISSIONS_FEATURES_CODE_INTERPRETER', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #505956799e30f576 — Environment-variable access.
repo/backend/open_webui/config.py:1876 
USER_PERMISSIONS_FEATURES_FOLDERS = os.getenv('USER_PERMISSIONS_FEATURES_FOLDERS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e7e0b49bb20ba816 — Environment-variable access.
repo/backend/open_webui/config.py:1878 
USER_PERMISSIONS_FEATURES_NOTES = os.getenv('USER_PERMISSIONS_FEATURES_NOTES', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a5f3de1f6640d6d6 — Environment-variable access.
repo/backend/open_webui/config.py:1880 
USER_PERMISSIONS_FEATURES_CHANNELS = os.getenv('USER_PERMISSIONS_FEATURES_CHANNELS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #323a33d13192298d — Environment-variable access.
repo/backend/open_webui/config.py:1882 
USER_PERMISSIONS_FEATURES_API_KEYS = os.getenv('USER_PERMISSIONS_FEATURES_API_KEYS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3d69b21dd4f031a3 — Environment-variable access.
repo/backend/open_webui/config.py:1884 
USER_PERMISSIONS_FEATURES_MEMORIES = os.getenv('USER_PERMISSIONS_FEATURES_MEMORIES', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #001e01c0c0376fe9 — Environment-variable access.
repo/backend/open_webui/config.py:1886 
USER_PERMISSIONS_FEATURES_AUTOMATIONS = os.getenv('USER_PERMISSIONS_FEATURES_AUTOMATIONS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7d8ccfe750ccdd28 — Environment-variable access.
repo/backend/open_webui/config.py:1888 
USER_PERMISSIONS_FEATURES_CALENDAR = os.getenv('USER_PERMISSIONS_FEATURES_CALENDAR', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #753aaecc0c90c42c — Environment-variable access.
repo/backend/open_webui/config.py:1891 
    os.getenv('USER_PERMISSIONS_FEATURES_USER_WEBHOOKS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #afeeede0f290610b — Environment-variable access.
repo/backend/open_webui/config.py:1895 
USER_PERMISSIONS_SETTINGS_INTERFACE = os.getenv('USER_PERMISSIONS_SETTINGS_INTERFACE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9683807ccb4ebbfa — Environment-variable access.
repo/backend/open_webui/config.py:1980 
ENABLE_FOLDERS = os.getenv('ENABLE_FOLDERS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d5b83b06078e7934 — Environment-variable access.
repo/backend/open_webui/config.py:1982 
FOLDER_MAX_FILE_COUNT = os.getenv('FOLDER_MAX_FILE_COUNT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f3bf0fa47c3b980d — Environment-variable access.
repo/backend/open_webui/config.py:1984 
ENABLE_CHANNELS = os.getenv('ENABLE_CHANNELS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c4d1edecfb3d393 — Environment-variable access.
repo/backend/open_webui/config.py:1986 
ENABLE_CALENDAR = os.getenv('ENABLE_CALENDAR', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d08e70a2ba5e80ba — Environment-variable access.
repo/backend/open_webui/config.py:1988 
ENABLE_AUTOMATIONS = os.getenv('ENABLE_AUTOMATIONS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0c58848fe560f52 — Environment-variable access.
repo/backend/open_webui/config.py:1990 
AUTOMATION_MAX_COUNT = os.getenv('AUTOMATION_MAX_COUNT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b1b2b2c055881b77 — Environment-variable access.
repo/backend/open_webui/config.py:1992 
AUTOMATION_MIN_INTERVAL = os.getenv('AUTOMATION_MIN_INTERVAL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12d56da61d3f922a — Environment-variable access.
repo/backend/open_webui/config.py:1994 
AUTOMATION_AUTH_TOKEN_EXPIRES_IN = os.getenv('AUTOMATION_AUTH_TOKEN_EXPIRES_IN', '1h')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe74995c11ad4590 — Environment-variable access.
repo/backend/open_webui/config.py:1996 
ENABLE_NOTES = os.getenv('ENABLE_NOTES', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #417697add88ad7e8 — Environment-variable access.
repo/backend/open_webui/config.py:1998 
ENABLE_USER_STATUS = os.getenv('ENABLE_USER_STATUS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2c00f02bef81415 — Environment-variable access.
repo/backend/open_webui/config.py:2000 
ENABLE_EVALUATION_ARENA_MODELS = os.getenv('ENABLE_EVALUATION_ARENA_MODELS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e07e2016be6d398a — Environment-variable access.
repo/backend/open_webui/config.py:2002 
    evaluation_arena_models = json.loads(os.getenv('EVALUATION_ARENA_MODELS', '[]'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e295f6cd3d7caba8 — Environment-variable access.
repo/backend/open_webui/config.py:2023 
WEBHOOK_URL = os.getenv('WEBHOOK_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13eb1fa8f8a93990 — Environment-variable access.
repo/backend/open_webui/config.py:2025 
ENABLE_ADMIN_EXPORT = os.getenv('ENABLE_ADMIN_EXPORT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d318398ea1797240 — Environment-variable access.
repo/backend/open_webui/config.py:2027 
ENABLE_ADMIN_WORKSPACE_CONTENT_ACCESS = os.getenv('ENABLE_ADMIN_WORKSPACE_CONTENT_ACCESS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13c94e1de503cf28 — Environment-variable access.
repo/backend/open_webui/config.py:2030 
    os.getenv(
        'BYPASS_ADMIN_ACCESS_CONTROL',
        os.getenv('ENABLE_ADMIN_WORKSPACE_CONTENT_ACCESS', 'True'),
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #550aa2b0cea49651 — Environment-variable access.
repo/backend/open_webui/config.py:2032 
        os.getenv('ENABLE_ADMIN_WORKSPACE_CONTENT_ACCESS', 'True'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13fb1d7c2a98de1e — Environment-variable access.
repo/backend/open_webui/config.py:2037 
ENABLE_ADMIN_CHAT_ACCESS = os.getenv('ENABLE_ADMIN_CHAT_ACCESS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c9c36cb17478c28f — Environment-variable access.
repo/backend/open_webui/config.py:2039 
ENABLE_ADMIN_ANALYTICS = os.getenv('ENABLE_ADMIN_ANALYTICS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6558f6a22f90196f — Environment-variable access.
repo/backend/open_webui/config.py:2041 
ENABLE_COMMUNITY_SHARING = os.getenv('ENABLE_COMMUNITY_SHARING', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ff70f810c5ff8ba9 — Environment-variable access.
repo/backend/open_webui/config.py:2043 
ENABLE_MESSAGE_RATING = os.getenv('ENABLE_MESSAGE_RATING', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c551810078a665cc — Environment-variable access.
repo/backend/open_webui/config.py:2045 
ENABLE_USER_WEBHOOKS = os.getenv('ENABLE_USER_WEBHOOKS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fa3f216d5c28726b — Environment-variable access.
repo/backend/open_webui/config.py:2048 
THREAD_POOL_SIZE = os.getenv('THREAD_POOL_SIZE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3afcbfb2b5b6f7e3 — Environment-variable access.
repo/backend/open_webui/config.py:2078 
CORS_ALLOW_ORIGIN = os.getenv('CORS_ALLOW_ORIGIN', '*').split(';')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ae1fd4a6b8d87133 — Environment-variable access.
repo/backend/open_webui/config.py:2083 
CORS_ALLOW_CUSTOM_SCHEME = os.getenv('CORS_ALLOW_CUSTOM_SCHEME', '').split(';')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f6b4d0a5eb3765a5 — Environment-variable access.
repo/backend/open_webui/config.py:2104 
    banners = json.loads(os.getenv('WEBUI_BANNERS', '[]'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85b859f940dcce0f — Environment-variable access.
repo/backend/open_webui/config.py:2113 
SHOW_ADMIN_DETAILS = os.getenv('SHOW_ADMIN_DETAILS', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c655865e698f595c — Environment-variable access.
repo/backend/open_webui/config.py:2115 
ADMIN_EMAIL = os.getenv('ADMIN_EMAIL', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f3189c18b0626806 — Environment-variable access.
repo/backend/open_webui/config.py:2123 
TASK_MODEL = os.getenv('TASK_MODEL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d07423d07c58696 — Environment-variable access.
repo/backend/open_webui/config.py:2125 
TASK_MODEL_EXTERNAL = os.getenv('TASK_MODEL_EXTERNAL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3fea798c5a35ba0a — Environment-variable access.
repo/backend/open_webui/config.py:2127 
ENABLE_CONTEXT_COMPACTION = os.getenv('ENABLE_CONTEXT_COMPACTION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b565b5e1b8aa0155 — Environment-variable access.
repo/backend/open_webui/config.py:2129 
CONTEXT_COMPACTION_TOKEN_THRESHOLD = int(os.getenv('CONTEXT_COMPACTION_TOKEN_THRESHOLD', '80000'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b5cc68048091b00c — Environment-variable access.
repo/backend/open_webui/config.py:2131 
CONTEXT_COMPACTION_PROMPT_TEMPLATE = os.getenv('CONTEXT_COMPACTION_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b76c0b2f39d6c9c9 — Environment-variable access.
repo/backend/open_webui/config.py:2133 
TITLE_GENERATION_PROMPT_TEMPLATE = os.getenv('TITLE_GENERATION_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #58d5944fefcdb95d — Environment-variable access.
repo/backend/open_webui/config.py:2159 
TAGS_GENERATION_PROMPT_TEMPLATE = os.getenv('TAGS_GENERATION_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45820ab6a74e7f86 — Environment-variable access.
repo/backend/open_webui/config.py:2179 
IMAGE_PROMPT_GENERATION_PROMPT_TEMPLATE = os.getenv('IMAGE_PROMPT_GENERATION_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe15e993c5eef367 — Environment-variable access.
repo/backend/open_webui/config.py:2202 
FOLLOW_UP_GENERATION_PROMPT_TEMPLATE = os.getenv('FOLLOW_UP_GENERATION_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c512f503868cd01c — Environment-variable access.
repo/backend/open_webui/config.py:2220 
ENABLE_FOLLOW_UP_GENERATION = os.getenv('ENABLE_FOLLOW_UP_GENERATION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #448b43432f822bca — Environment-variable access.
repo/backend/open_webui/config.py:2222 
ENABLE_TAGS_GENERATION = os.getenv('ENABLE_TAGS_GENERATION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d6f3b5e56a9159d6 — Environment-variable access.
repo/backend/open_webui/config.py:2224 
ENABLE_TITLE_GENERATION = os.getenv('ENABLE_TITLE_GENERATION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3ab3616041442bbb — Environment-variable access.
repo/backend/open_webui/config.py:2227 
ENABLE_SEARCH_QUERY_GENERATION = os.getenv('ENABLE_SEARCH_QUERY_GENERATION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4462e3a8ccd05d22 — Environment-variable access.
repo/backend/open_webui/config.py:2229 
ENABLE_RETRIEVAL_QUERY_GENERATION = os.getenv('ENABLE_RETRIEVAL_QUERY_GENERATION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f983ea4435a5750b — Environment-variable access.
repo/backend/open_webui/config.py:2232 
QUERY_GENERATION_PROMPT_TEMPLATE = os.getenv('QUERY_GENERATION_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1eec6491567ba132 — Environment-variable access.
repo/backend/open_webui/config.py:2258 
ENABLE_AUTOCOMPLETE_GENERATION = os.getenv('ENABLE_AUTOCOMPLETE_GENERATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #abaa6b9799a69dff — Environment-variable access.
repo/backend/open_webui/config.py:2260 
AUTOCOMPLETE_GENERATION_INPUT_MAX_LENGTH = int(os.getenv('AUTOCOMPLETE_GENERATION_INPUT_MAX_LENGTH', '-1'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #67f9ce6ece5e51fd — Environment-variable access.
repo/backend/open_webui/config.py:2262 
AUTOCOMPLETE_GENERATION_PROMPT_TEMPLATE = os.getenv('AUTOCOMPLETE_GENERATION_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #643bc6fafa7b7418 — Environment-variable access.
repo/backend/open_webui/config.py:2308 
VOICE_MODE_PROMPT_TEMPLATE = os.getenv('VOICE_MODE_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8937d9bc078cece2 — Environment-variable access.
repo/backend/open_webui/config.py:2310 
ENABLE_VOICE_MODE_PROMPT = os.getenv('ENABLE_VOICE_MODE_PROMPT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #682acd74459cefb2 — Environment-variable access.
repo/backend/open_webui/config.py:2337 
TOOLS_FUNCTION_CALLING_PROMPT_TEMPLATE = os.getenv('TOOLS_FUNCTION_CALLING_PROMPT_TEMPLATE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #209a20cca7f5f2ec — Environment-variable access.
repo/backend/open_webui/config.py:2379 
ENABLE_API_KEYS = os.getenv('ENABLE_API_KEYS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #030bfc14aceecbcc — Environment-variable access.
repo/backend/open_webui/config.py:2382 
    os.getenv(
        'ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS',
        os.getenv('ENABLE_API_KEY_ENDPOINT_RESTRICTIONS', 'False'),
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #34e16fabfe6defb5 — Environment-variable access.
repo/backend/open_webui/config.py:2384 
        os.getenv('ENABLE_API_KEY_ENDPOINT_RESTRICTIONS', 'False'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72668dd7a041fd4b — Environment-variable access.
repo/backend/open_webui/config.py:2389 
API_KEYS_ALLOWED_ENDPOINTS = os.getenv('API_KEYS_ALLOWED_ENDPOINTS', os.getenv('API_KEY_ALLOWED_ENDPOINTS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6c677c4663058c5c — Environment-variable access.
repo/backend/open_webui/config.py:2391 
JWT_EXPIRES_IN = os.getenv('JWT_EXPIRES_IN', '4w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f729a5a2d25e8bb7 — Environment-variable access.
repo/backend/open_webui/config.py:2403 
ENABLE_OAUTH_SIGNUP = os.getenv('ENABLE_OAUTH_SIGNUP', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #733af8353eb4d584 — Environment-variable access.
repo/backend/open_webui/config.py:2405 
OAUTH_AUTO_REDIRECT = os.getenv('OAUTH_AUTO_REDIRECT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0c7ce746187a81b — Environment-variable access.
repo/backend/open_webui/config.py:2407 
OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE = os.getenv('OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #90838430ad872a77 — Environment-variable access.
repo/backend/open_webui/config.py:2410 
OAUTH_MERGE_ACCOUNTS_BY_EMAIL = os.getenv('OAUTH_MERGE_ACCOUNTS_BY_EMAIL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb542b71e5702efc — Environment-variable access.
repo/backend/open_webui/config.py:2414 
GOOGLE_CLIENT_ID = os.getenv('GOOGLE_CLIENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8c8b11b0a1873f47 — Environment-variable access.
repo/backend/open_webui/config.py:2416 
GOOGLE_CLIENT_SECRET = os.getenv('GOOGLE_CLIENT_SECRET', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aba6dd94a62c4c8e — Environment-variable access.
repo/backend/open_webui/config.py:2419 
GOOGLE_OAUTH_SCOPE = os.getenv('GOOGLE_OAUTH_SCOPE', 'openid email profile')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #47c65942699939fc — Environment-variable access.
repo/backend/open_webui/config.py:2421 
GOOGLE_REDIRECT_URI = os.getenv('GOOGLE_REDIRECT_URI', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ba16e678b44f89b — Environment-variable access.
repo/backend/open_webui/config.py:2424 
_google_oauth_authorize_params = os.getenv('GOOGLE_OAUTH_AUTHORIZE_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69bf42ba5200dffa — Environment-variable access.
repo/backend/open_webui/config.py:2435 
MICROSOFT_CLIENT_ID = os.getenv('MICROSOFT_CLIENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9c1b2d99df666bc0 — Environment-variable access.
repo/backend/open_webui/config.py:2437 
MICROSOFT_CLIENT_SECRET = os.getenv('MICROSOFT_CLIENT_SECRET', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f59dfeba5157babf — Environment-variable access.
repo/backend/open_webui/config.py:2439 
MICROSOFT_CLIENT_TENANT_ID = os.getenv('MICROSOFT_CLIENT_TENANT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0fa636ced59fd3fa — Environment-variable access.
repo/backend/open_webui/config.py:2441 
MICROSOFT_CLIENT_LOGIN_BASE_URL = os.getenv('MICROSOFT_CLIENT_LOGIN_BASE_URL', 'https://login.microsoftonline.com')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b8eb8572fbc4ceb — Environment-variable access.
repo/backend/open_webui/config.py:2443 
MICROSOFT_CLIENT_PICTURE_URL = os.getenv(
    'MICROSOFT_CLIENT_PICTURE_URL',
    'https://graph.microsoft.com/v1.0/me/photo/$value',
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f14941de80f06833 — Environment-variable access.
repo/backend/open_webui/config.py:2449 
MICROSOFT_OAUTH_SCOPE = os.getenv('MICROSOFT_OAUTH_SCOPE', 'openid email profile')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b31d079399053c9f — Environment-variable access.
repo/backend/open_webui/config.py:2451 
MICROSOFT_REDIRECT_URI = os.getenv('MICROSOFT_REDIRECT_URI', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #326336a730d32ff6 — Environment-variable access.
repo/backend/open_webui/config.py:2453 
GITHUB_CLIENT_ID = os.getenv('GITHUB_CLIENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e7776e962c81037 — Environment-variable access.
repo/backend/open_webui/config.py:2455 
GITHUB_CLIENT_SECRET = os.getenv('GITHUB_CLIENT_SECRET', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #418a1802ad13ef68 — Environment-variable access.
repo/backend/open_webui/config.py:2457 
GITHUB_CLIENT_SCOPE = os.getenv('GITHUB_CLIENT_SCOPE', 'user:email')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d933f25f418f5205 — Environment-variable access.
repo/backend/open_webui/config.py:2459 
GITHUB_CLIENT_REDIRECT_URI = os.getenv('GITHUB_CLIENT_REDIRECT_URI', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #268c396422792777 — Environment-variable access.
repo/backend/open_webui/config.py:2461 
OAUTH_CLIENT_ID = os.getenv('OAUTH_CLIENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d6db86c205591f00 — Environment-variable access.
repo/backend/open_webui/config.py:2463 
OAUTH_CLIENT_SECRET = os.getenv('OAUTH_CLIENT_SECRET', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df66452c2e0eaa34 — Environment-variable access.
repo/backend/open_webui/config.py:2465 
OPENID_PROVIDER_URL = os.getenv('OPENID_PROVIDER_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f86cd44ea74a7585 — Environment-variable access.
repo/backend/open_webui/config.py:2467 
OPENID_END_SESSION_ENDPOINT = os.getenv('OPENID_END_SESSION_ENDPOINT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c9b8e1230cf1d7bf — Environment-variable access.
repo/backend/open_webui/config.py:2469 
OPENID_REDIRECT_URI = os.getenv('OPENID_REDIRECT_URI', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f66fc5ea558703b6 — Environment-variable access.
repo/backend/open_webui/config.py:2471 
OAUTH_SCOPES = os.getenv('OAUTH_SCOPES', 'openid email profile')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7641fbe762e37c81 — Environment-variable access.
repo/backend/open_webui/config.py:2473 
OAUTH_TIMEOUT = os.getenv('OAUTH_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37f3178ea1a6bdb0 — Environment-variable access.
repo/backend/open_webui/config.py:2475 
OAUTH_TOKEN_ENDPOINT_AUTH_METHOD = os.getenv('OAUTH_TOKEN_ENDPOINT_AUTH_METHOD', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f7a7c28a4ff40be — Environment-variable access.
repo/backend/open_webui/config.py:2477 
OAUTH_CODE_CHALLENGE_METHOD = os.getenv('OAUTH_CODE_CHALLENGE_METHOD', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d483b3effebd3c1 — Environment-variable access.
repo/backend/open_webui/config.py:2479 
OAUTH_PROVIDER_NAME = os.getenv('OAUTH_PROVIDER_NAME', 'SSO')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fed197a0ce53bd2e — Environment-variable access.
repo/backend/open_webui/config.py:2481 
OAUTH_SUB_CLAIM = os.getenv('OAUTH_SUB_CLAIM', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0264d4cd6e0dad26 — Environment-variable access.
repo/backend/open_webui/config.py:2483 
OAUTH_USERNAME_CLAIM = os.getenv('OAUTH_USERNAME_CLAIM', 'name')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f120605b8630199b — Environment-variable access.
repo/backend/open_webui/config.py:2486 
OAUTH_PICTURE_CLAIM = os.getenv('OAUTH_PICTURE_CLAIM', 'picture')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c979edb4d8197974 — Environment-variable access.
repo/backend/open_webui/config.py:2488 
OAUTH_EMAIL_CLAIM = os.getenv('OAUTH_EMAIL_CLAIM', 'email')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #683baf5a404e28dd — Environment-variable access.
repo/backend/open_webui/config.py:2490 
OAUTH_GROUPS_CLAIM = os.getenv('OAUTH_GROUPS_CLAIM', os.getenv('OAUTH_GROUP_CLAIM', 'groups'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5ec25bc3d314a4b1 — Environment-variable access.
repo/backend/open_webui/config.py:2492 
FEISHU_CLIENT_ID = os.getenv('FEISHU_CLIENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b2358653cae803f4 — Environment-variable access.
repo/backend/open_webui/config.py:2494 
FEISHU_CLIENT_SECRET = os.getenv('FEISHU_CLIENT_SECRET', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c91339abd0adbc3 — Environment-variable access.
repo/backend/open_webui/config.py:2496 
FEISHU_OAUTH_SCOPE = os.getenv('FEISHU_OAUTH_SCOPE', 'contact:user.base:readonly')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f28015febe7c80a — Environment-variable access.
repo/backend/open_webui/config.py:2498 
FEISHU_REDIRECT_URI = os.getenv('FEISHU_REDIRECT_URI', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca2a3ed967105bb5 — Environment-variable access.
repo/backend/open_webui/config.py:2500 
ENABLE_OAUTH_ROLE_MANAGEMENT = os.getenv('ENABLE_OAUTH_ROLE_MANAGEMENT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #78f795440faa5a84 — Environment-variable access.
repo/backend/open_webui/config.py:2502 
ENABLE_OAUTH_GROUP_MANAGEMENT = os.getenv('ENABLE_OAUTH_GROUP_MANAGEMENT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7dd0c03e3b17cae3 — Environment-variable access.
repo/backend/open_webui/config.py:2504 
ENABLE_OAUTH_GROUP_CREATION = os.getenv('ENABLE_OAUTH_GROUP_CREATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e48274a842f36090 — Environment-variable access.
repo/backend/open_webui/config.py:2507 
oauth_group_default_share = os.getenv('OAUTH_GROUP_DEFAULT_SHARE', 'true').strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #91fb7cf0b058c475 — Environment-variable access.
repo/backend/open_webui/config.py:2511 
OAUTH_BLOCKED_GROUPS = os.getenv('OAUTH_BLOCKED_GROUPS', '[]')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #914b3be0f1469830 — Environment-variable access.
repo/backend/open_webui/config.py:2513 
OAUTH_GROUPS_SEPARATOR = os.getenv('OAUTH_GROUPS_SEPARATOR', ';')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5522229fdd2e5349 — Environment-variable access.
repo/backend/open_webui/config.py:2515 
OAUTH_ROLES_CLAIM = os.getenv('OAUTH_ROLES_CLAIM', 'roles')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #50e2e222375c6b51 — Environment-variable access.
repo/backend/open_webui/config.py:2517 
OAUTH_ROLES_SEPARATOR = os.getenv('OAUTH_ROLES_SEPARATOR', ',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9d711f436c0381e — Environment-variable access.
repo/backend/open_webui/config.py:2521 
    for role in os.getenv('OAUTH_ALLOWED_ROLES', f'user{OAUTH_ROLES_SEPARATOR}admin').split(OAUTH_ROLES_SEPARATOR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #61cc5e5a49aca69f — Environment-variable access.
repo/backend/open_webui/config.py:2526 
    role.strip() for role in os.getenv('OAUTH_ADMIN_ROLES', 'admin').split(OAUTH_ROLES_SEPARATOR) if role

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #592f74e62cc7c8c7 — Environment-variable access.
repo/backend/open_webui/config.py:2529 
OAUTH_ALLOWED_DOMAINS = [domain.strip() for domain in os.getenv('OAUTH_ALLOWED_DOMAINS', '*').split(',')]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd2dde856a246d1d — Environment-variable access.
repo/backend/open_webui/config.py:2531 
OAUTH_UPDATE_PICTURE_ON_LOGIN = os.getenv('OAUTH_UPDATE_PICTURE_ON_LOGIN', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3ed63f9ddcd19f71 — Environment-variable access.
repo/backend/open_webui/config.py:2533 
OAUTH_UPDATE_NAME_ON_LOGIN = os.getenv('OAUTH_UPDATE_NAME_ON_LOGIN', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #361c53f3e0122b9a — Environment-variable access.
repo/backend/open_webui/config.py:2535 
OAUTH_UPDATE_EMAIL_ON_LOGIN = os.getenv('OAUTH_UPDATE_EMAIL_ON_LOGIN', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #88b9bf9fa023f069 — Environment-variable access.
repo/backend/open_webui/config.py:2538 
    os.getenv('OAUTH_ACCESS_TOKEN_REQUEST_INCLUDE_CLIENT_ID', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f571e9876776d2c0 — Environment-variable access.
repo/backend/open_webui/config.py:2541 
OAUTH_AUDIENCE = os.getenv('OAUTH_AUDIENCE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #98f6287c89303390 — Environment-variable access.
repo/backend/open_webui/config.py:2544 
_oauth_authorize_params = os.getenv('OAUTH_AUTHORIZE_PARAMS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f552524ff3c2c02c — Environment-variable access.
repo/backend/open_webui/config.py:2711 
ENABLE_LDAP = os.getenv('ENABLE_LDAP', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7fe6d9b3810a0a38 — Environment-variable access.
repo/backend/open_webui/config.py:2713 
LDAP_SERVER_LABEL = os.getenv('LDAP_SERVER_LABEL', 'LDAP Server')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fedf3e8ec9fb4b32 — Environment-variable access.
repo/backend/open_webui/config.py:2715 
LDAP_SERVER_HOST = os.getenv('LDAP_SERVER_HOST', 'localhost')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d3bfb7ee19c182e — Environment-variable access.
repo/backend/open_webui/config.py:2717 
LDAP_SERVER_PORT = int(os.getenv('LDAP_SERVER_PORT', '389'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d7f27db239b2d274 — Environment-variable access.
repo/backend/open_webui/config.py:2719 
LDAP_ATTRIBUTE_FOR_MAIL = os.getenv('LDAP_ATTRIBUTE_FOR_MAIL', 'mail')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #11bc1a0a2ada3fae — Environment-variable access.
repo/backend/open_webui/config.py:2721 
LDAP_ATTRIBUTE_FOR_USERNAME = os.getenv('LDAP_ATTRIBUTE_FOR_USERNAME', 'uid')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c3be4ce576a1e045 — Environment-variable access.
repo/backend/open_webui/config.py:2723 
LDAP_APP_DN = os.getenv('LDAP_APP_DN', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd50071ac21438d5 — Environment-variable access.
repo/backend/open_webui/config.py:2725 
LDAP_APP_PASSWORD = os.getenv('LDAP_APP_PASSWORD', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2ddb3881057a4de — Environment-variable access.
repo/backend/open_webui/config.py:2727 
LDAP_SEARCH_BASE = os.getenv('LDAP_SEARCH_BASE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc7f5de4cfc62bfc — Environment-variable access.
repo/backend/open_webui/config.py:2729 
LDAP_SEARCH_FILTERS = os.getenv('LDAP_SEARCH_FILTER', os.getenv('LDAP_SEARCH_FILTERS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3da6a1b2da205fef — Environment-variable access.
repo/backend/open_webui/config.py:2731 
LDAP_USE_TLS = os.getenv('LDAP_USE_TLS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9f94bb660ba70dc0 — Environment-variable access.
repo/backend/open_webui/config.py:2733 
LDAP_CA_CERT_FILE = os.getenv('LDAP_CA_CERT_FILE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7729fb2787240e87 — Environment-variable access.
repo/backend/open_webui/config.py:2735 
LDAP_VALIDATE_CERT = os.getenv('LDAP_VALIDATE_CERT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b2e155a7f1918f00 — Environment-variable access.
repo/backend/open_webui/config.py:2737 
LDAP_CIPHERS = os.getenv('LDAP_CIPHERS', 'ALL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db49d43312d35bd8 — Environment-variable access.
repo/backend/open_webui/config.py:2739 
ENABLE_LDAP_GROUP_MANAGEMENT = os.getenv('ENABLE_LDAP_GROUP_MANAGEMENT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d5f25fcd97a0c6a7 — Environment-variable access.
repo/backend/open_webui/config.py:2741 
ENABLE_LDAP_GROUP_CREATION = os.getenv('ENABLE_LDAP_GROUP_CREATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a0a8510afe861df — Environment-variable access.
repo/backend/open_webui/config.py:2743 
LDAP_ATTRIBUTE_FOR_GROUPS = os.getenv('LDAP_ATTRIBUTE_FOR_GROUPS', 'memberOf')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fef50a6c8d315f7d — Environment-variable access.
repo/backend/open_webui/config.py:3129 
ENABLE_PERSISTENT_CONFIG = os.getenv('ENABLE_PERSISTENT_CONFIG', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6a19bcd5ec4c2c9a — Environment-variable access.
repo/backend/open_webui/config.py:3130 
ENABLE_OAUTH_PERSISTENT_CONFIG = os.getenv('ENABLE_OAUTH_PERSISTENT_CONFIG', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f08c4d18fd108415 — Environment-variable access.
repo/backend/open_webui/env.py:42 
DOCKER = os.getenv('DOCKER', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7deee10b8ad50d35 — Environment-variable access.
repo/backend/open_webui/env.py:44 
USE_CUDA = os.getenv('USE_CUDA_DOCKER', 'false')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca044a19ab4775de — Environment-variable access.
repo/backend/open_webui/env.py:57 
        os.environ['USE_CUDA_DOCKER'] = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #754028e5cf7e9754 — Environment-variable access.
repo/backend/open_webui/env.py:104 
LOG_FORMAT = os.getenv('LOG_FORMAT', '').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9324d484e2c0f82 — Environment-variable access.
repo/backend/open_webui/env.py:106 
GLOBAL_LOG_LEVEL = os.getenv('GLOBAL_LOG_LEVEL', '').upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #43e94b06100d9478 — Environment-variable access.
repo/backend/open_webui/env.py:132 
ENV = os.getenv('ENV', 'dev')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b1a752da013e79d — Environment-variable access.
repo/backend/open_webui/env.py:134 
FROM_INIT_PY = os.getenv('FROM_INIT_PY', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2cb621749959747 — Filesystem access.
repo/backend/open_webui/env.py:140 
        PACKAGE_DATA = json.loads((BASE_DIR / 'package.json').read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5bae9e3560a18184 — Environment-variable access.
repo/backend/open_webui/env.py:147 
DEPLOYMENT_ID = os.getenv('DEPLOYMENT_ID', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9991324acf8a81ee — Environment-variable access.
repo/backend/open_webui/env.py:148 
INSTANCE_ID = os.getenv('INSTANCE_ID', str(uuid4()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77c5438ff2e5db67 — Environment-variable access.
repo/backend/open_webui/env.py:150 
ENABLE_DB_MIGRATIONS = os.getenv('ENABLE_DB_MIGRATIONS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e75831beed07698e — Filesystem access.
repo/backend/open_webui/env.py:174 
    with open(str(changelog_path.absolute()), encoding='utf8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d525e51791bd8e84 — Environment-variable access.
repo/backend/open_webui/env.py:216 
DATA_DIR = Path(os.getenv('DATA_DIR', BACKEND_DIR / 'data')).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #62663c0525299da4 — Environment-variable access.
repo/backend/open_webui/env.py:219 
    NEW_DATA_DIR = Path(os.getenv('DATA_DIR', OPEN_WEBUI_DIR / 'data')).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ee3b90d5f1aa9ef9 — Environment-variable access.
repo/backend/open_webui/env.py:238 
    DATA_DIR = Path(os.getenv('DATA_DIR', OPEN_WEBUI_DIR / 'data'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f8442075a82c6d75 — Environment-variable access.
repo/backend/open_webui/env.py:240 
STATIC_DIR = Path(os.getenv('STATIC_DIR', OPEN_WEBUI_DIR / 'static'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #575c3ffbae61f50b — Environment-variable access.
repo/backend/open_webui/env.py:242 
FONTS_DIR = Path(os.getenv('FONTS_DIR', OPEN_WEBUI_DIR / 'static' / 'fonts'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45cc5eb07ff09834 — Environment-variable access.
repo/backend/open_webui/env.py:244 
FRONTEND_BUILD_DIR = Path(os.getenv('FRONTEND_BUILD_DIR', BASE_DIR / 'build')).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4fcb743bb701451a — Environment-variable access.
repo/backend/open_webui/env.py:247 
    FRONTEND_BUILD_DIR = Path(os.getenv('FRONTEND_BUILD_DIR', OPEN_WEBUI_DIR / 'frontend')).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f8778608409205b — Environment-variable access.
repo/backend/open_webui/env.py:261 
DATABASE_URL = os.getenv('DATABASE_URL', f'sqlite:///{DATA_DIR}/webui.db')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #89ca3c3d560f9e53 — Environment-variable access.
repo/backend/open_webui/env.py:263 
DATABASE_TYPE = os.getenv('DATABASE_TYPE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6899dc42b6e8210f — Environment-variable access.
repo/backend/open_webui/env.py:264 
DATABASE_USER = os.getenv('DATABASE_USER')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ead4371a302d7a31 — Environment-variable access.
repo/backend/open_webui/env.py:265 
DATABASE_PASSWORD = os.getenv('DATABASE_PASSWORD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b55a4097e2be9551 — Environment-variable access.
repo/backend/open_webui/env.py:276 
    'db_host': os.getenv('DATABASE_HOST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c153bf3bc07c396a — Environment-variable access.
repo/backend/open_webui/env.py:277 
    'db_port': os.getenv('DATABASE_PORT'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4b69d050b7f8d85 — Environment-variable access.
repo/backend/open_webui/env.py:278 
    'db_name': os.getenv('DATABASE_NAME'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d8932f408f5af85 — Environment-variable access.
repo/backend/open_webui/env.py:285 
elif DATABASE_TYPE == 'sqlite+sqlcipher' and not os.getenv('DATABASE_URL'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4d4eb4fbcbf3205 — Environment-variable access.
repo/backend/open_webui/env.py:293 
DATABASE_SCHEMA = os.getenv('DATABASE_SCHEMA', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f55a5ea4d47f53e — Environment-variable access.
repo/backend/open_webui/env.py:294 
DATABASE_ENABLE_IAM_TOKEN_AUTH = os.getenv('DATABASE_ENABLE_IAM_TOKEN_AUTH', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3ec855f576a287f5 — Environment-variable access.
repo/backend/open_webui/env.py:296 
_pool_size_raw = os.getenv('DATABASE_POOL_SIZE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef77f96aa9fa0f47 — Environment-variable access.
repo/backend/open_webui/env.py:302 
_pool_overflow_raw = os.getenv('DATABASE_POOL_MAX_OVERFLOW', '0')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db5d530db8df2ebf — Environment-variable access.
repo/backend/open_webui/env.py:308 
_pool_timeout_raw = os.getenv('DATABASE_POOL_TIMEOUT', '30')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bf3d312bea8e4baf — Environment-variable access.
repo/backend/open_webui/env.py:314 
_pool_recycle_raw = os.getenv('DATABASE_POOL_RECYCLE', '3600')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #518dbb61201878d9 — Environment-variable access.
repo/backend/open_webui/env.py:320 
DATABASE_ENABLE_SQLITE_WAL = os.getenv('DATABASE_ENABLE_SQLITE_WAL', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71a921ecc0873f61 — Environment-variable access.
repo/backend/open_webui/env.py:328 
DATABASE_SQLITE_PRAGMA_SYNCHRONOUS = os.getenv('DATABASE_SQLITE_PRAGMA_SYNCHRONOUS', 'NORMAL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6d780ac92bda1ef0 — Environment-variable access.
repo/backend/open_webui/env.py:332 
DATABASE_SQLITE_PRAGMA_BUSY_TIMEOUT = os.getenv('DATABASE_SQLITE_PRAGMA_BUSY_TIMEOUT', '5000')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f12d8f0a62e777b8 — Environment-variable access.
repo/backend/open_webui/env.py:335 
DATABASE_SQLITE_PRAGMA_CACHE_SIZE = os.getenv('DATABASE_SQLITE_PRAGMA_CACHE_SIZE', '-65536')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5dd9112c284cea40 — Environment-variable access.
repo/backend/open_webui/env.py:339 
DATABASE_SQLITE_PRAGMA_TEMP_STORE = os.getenv('DATABASE_SQLITE_PRAGMA_TEMP_STORE', 'MEMORY')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b0ed2a2eadcd0fe — Environment-variable access.
repo/backend/open_webui/env.py:343 
DATABASE_SQLITE_PRAGMA_MMAP_SIZE = os.getenv('DATABASE_SQLITE_PRAGMA_MMAP_SIZE', '268435456')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3bc87cbae75fd773 — Environment-variable access.
repo/backend/open_webui/env.py:348 
DATABASE_SQLITE_PRAGMA_JOURNAL_SIZE_LIMIT = os.getenv('DATABASE_SQLITE_PRAGMA_JOURNAL_SIZE_LIMIT', '67108864')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3c3f9dd4e829209 — Environment-variable access.
repo/backend/open_webui/env.py:350 
DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL = os.getenv('DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e02290f1a8287f0e — Environment-variable access.
repo/backend/open_webui/env.py:357 
DATABASE_ENABLE_SESSION_SHARING = os.getenv('DATABASE_ENABLE_SESSION_SHARING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #999d34e26d64cddc — Environment-variable access.
repo/backend/open_webui/env.py:358 
ENABLE_PUBLIC_ACTIVE_USERS_COUNT = os.getenv('ENABLE_PUBLIC_ACTIVE_USERS_COUNT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18350e1253b1dec3 — Environment-variable access.
repo/backend/open_webui/env.py:359 
RESET_CONFIG_ON_START = os.getenv('RESET_CONFIG_ON_START', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #91c76d766f711bd7 — Environment-variable access.
repo/backend/open_webui/env.py:360 
ENABLE_REALTIME_CHAT_SAVE = os.getenv('ENABLE_REALTIME_CHAT_SAVE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #603c58342ff31165 — Environment-variable access.
repo/backend/open_webui/env.py:361 
ENABLE_QUERIES_CACHE = os.getenv('ENABLE_QUERIES_CACHE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7829f73d3395bf44 — Environment-variable access.
repo/backend/open_webui/env.py:362 
RAG_SYSTEM_CONTEXT = os.getenv('RAG_SYSTEM_CONTEXT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c3a2df7e180270f8 — Environment-variable access.
repo/backend/open_webui/env.py:368 
REDIS_URL = os.getenv('REDIS_URL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18d9656683154b5b — Environment-variable access.
repo/backend/open_webui/env.py:369 
REDIS_CLUSTER = os.getenv('REDIS_CLUSTER', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #932b004a0f84bbf4 — Environment-variable access.
repo/backend/open_webui/env.py:371 
REDIS_KEY_PREFIX = os.getenv('REDIS_KEY_PREFIX', 'open-webui')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a1e2da992e457ba3 — Environment-variable access.
repo/backend/open_webui/env.py:373 
REDIS_SENTINEL_HOSTS = os.getenv('REDIS_SENTINEL_HOSTS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77030b3c7df2be71 — Environment-variable access.
repo/backend/open_webui/env.py:374 
REDIS_SENTINEL_PORT = os.getenv('REDIS_SENTINEL_PORT', '26379')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f10e737bc47af93 — Environment-variable access.
repo/backend/open_webui/env.py:377 
REDIS_SENTINEL_MAX_RETRY_COUNT = os.getenv('REDIS_SENTINEL_MAX_RETRY_COUNT', '2')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #964f16f300cc3d46 — Environment-variable access.
repo/backend/open_webui/env.py:386 
REDIS_SOCKET_CONNECT_TIMEOUT = os.getenv('REDIS_SOCKET_CONNECT_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f9be1efb4a86b08 — Environment-variable access.
repo/backend/open_webui/env.py:397 
REDIS_SOCKET_KEEPALIVE = os.getenv('REDIS_SOCKET_KEEPALIVE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bafa129e5f6b5acd — Environment-variable access.
repo/backend/open_webui/env.py:405 
REDIS_HEALTH_CHECK_INTERVAL = os.getenv('REDIS_HEALTH_CHECK_INTERVAL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c659c07429a31611 — Environment-variable access.
repo/backend/open_webui/env.py:413 
REDIS_RECONNECT_DELAY = os.getenv('REDIS_RECONNECT_DELAY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #802fad5b2592562c — Environment-variable access.
repo/backend/open_webui/env.py:430 
    UVICORN_WORKERS = max(int(os.getenv('UVICORN_WORKERS', '1')), 1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #753248f186f6aba4 — Environment-variable access.
repo/backend/open_webui/env.py:438 
ENABLE_WEBSOCKET_SUPPORT = os.getenv('ENABLE_WEBSOCKET_SUPPORT', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f287337d3f08d08f — Environment-variable access.
repo/backend/open_webui/env.py:441 
WEBSOCKET_MANAGER = os.getenv('WEBSOCKET_MANAGER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de671101a33b3d76 — Environment-variable access.
repo/backend/open_webui/env.py:443 
WEBSOCKET_REDIS_OPTIONS = os.getenv('WEBSOCKET_REDIS_OPTIONS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d36b1f2653cf3ae5 — Environment-variable access.
repo/backend/open_webui/env.py:458 
WEBSOCKET_REDIS_URL = os.getenv('WEBSOCKET_REDIS_URL', REDIS_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12ae85226f0882ed — Environment-variable access.
repo/backend/open_webui/env.py:459 
WEBSOCKET_REDIS_CLUSTER = os.getenv('WEBSOCKET_REDIS_CLUSTER', str(REDIS_CLUSTER)).lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b6a64ee9da164b5f — Environment-variable access.
repo/backend/open_webui/env.py:461 
websocket_redis_lock_timeout = os.getenv('WEBSOCKET_REDIS_LOCK_TIMEOUT', '60')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #20d78aad10b215ec — Environment-variable access.
repo/backend/open_webui/env.py:468 
WEBSOCKET_SENTINEL_HOSTS = os.getenv('WEBSOCKET_SENTINEL_HOSTS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0318f0aac84d4d9e — Environment-variable access.
repo/backend/open_webui/env.py:469 
WEBSOCKET_SENTINEL_PORT = os.getenv('WEBSOCKET_SENTINEL_PORT', '26379')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #96a1d50b4dbc217f — Environment-variable access.
repo/backend/open_webui/env.py:470 
WEBSOCKET_SERVER_LOGGING = os.getenv('WEBSOCKET_SERVER_LOGGING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #50bfb9ee3cb48542 — Environment-variable access.
repo/backend/open_webui/env.py:472 
    os.getenv(
        'WEBSOCKET_SERVER_ENGINEIO_LOGGING',
        os.getenv('WEBSOCKET_SERVER_LOGGING', 'False'),
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #388cd3eaea5cc4dc — Environment-variable access.
repo/backend/open_webui/env.py:474 
        os.getenv('WEBSOCKET_SERVER_LOGGING', 'False'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71b10d31f51ac6c9 — Environment-variable access.
repo/backend/open_webui/env.py:478 
WEBSOCKET_SERVER_PING_TIMEOUT = os.getenv('WEBSOCKET_SERVER_PING_TIMEOUT', '20')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4235430e84bf22f9 — Environment-variable access.
repo/backend/open_webui/env.py:484 
WEBSOCKET_SERVER_PING_INTERVAL = os.getenv('WEBSOCKET_SERVER_PING_INTERVAL', '25')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74daf400a8267a80 — Environment-variable access.
repo/backend/open_webui/env.py:490 
WEBSOCKET_EVENT_CALLER_TIMEOUT = os.getenv('WEBSOCKET_EVENT_CALLER_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc6acc3f371fa42f — Environment-variable access.
repo/backend/open_webui/env.py:512 
AIOHTTP_CLIENT_SSL_CERT_FILE = os.getenv('AIOHTTP_CLIENT_SSL_CERT_FILE', '').strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb1f0e6bc345e4a6 — Environment-variable access.
repo/backend/open_webui/env.py:560 
REQUESTS_VERIFY = os.getenv('REQUESTS_VERIFY', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #31a5554ad950a3e7 — Environment-variable access.
repo/backend/open_webui/env.py:562 
_aiohttp_timeout_raw = os.getenv('AIOHTTP_CLIENT_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3959ff770e13c812 — Environment-variable access.
repo/backend/open_webui/env.py:572 
AIOHTTP_CLIENT_SESSION_SSL = _parse_ssl_env(os.getenv('AIOHTTP_CLIENT_SESSION_SSL', 'True'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e03939cf78e2f781 — Environment-variable access.
repo/backend/open_webui/env.py:575 
AIOHTTP_CLIENT_ALLOW_REDIRECTS = os.getenv('AIOHTTP_CLIENT_ALLOW_REDIRECTS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ff666d657e311dfa — Environment-variable access.
repo/backend/open_webui/env.py:580 
USER_AGENT = os.getenv('USER_AGENT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9f382dd006f3aa34 — Environment-variable access.
repo/backend/open_webui/env.py:582 
_model_list_timeout_raw = os.getenv(
    'AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST',
    os.getenv('AIOHTTP_CLIENT_TIMEOUT_OPENAI_MODEL_LIST', '10'),
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f11f27619bff5b2 — Environment-variable access.
repo/backend/open_webui/env.py:584 
    os.getenv('AIOHTTP_CLIENT_TIMEOUT_OPENAI_MODEL_LIST', '10'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1bb1b8e3f22ca361 — Environment-variable access.
repo/backend/open_webui/env.py:591 
_tool_data_timeout_raw = os.getenv('AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER_DATA', '10')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ed323050a5a5327 — Environment-variable access.
repo/backend/open_webui/env.py:601 
AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL = _parse_ssl_env(os.getenv('AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL', 'True'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71bc8bdad44d7be7 — Environment-variable access.
repo/backend/open_webui/env.py:603 
AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER = os.getenv('AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #81bb98cf8991574d — Environment-variable access.
repo/backend/open_webui/env.py:616 
MCP_INITIALIZE_TIMEOUT = os.getenv('MCP_INITIALIZE_TIMEOUT', '10')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5ea760374a88f3bd — Environment-variable access.
repo/backend/open_webui/env.py:627 
AIOHTTP_POOL_CONNECTIONS = os.getenv('AIOHTTP_POOL_CONNECTIONS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #defaa48a52e89d83 — Environment-variable access.
repo/backend/open_webui/env.py:636 
AIOHTTP_POOL_CONNECTIONS_PER_HOST = os.getenv('AIOHTTP_POOL_CONNECTIONS_PER_HOST', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d4e61519af97ca82 — Environment-variable access.
repo/backend/open_webui/env.py:645 
AIOHTTP_POOL_DNS_TTL = os.getenv('AIOHTTP_POOL_DNS_TTL', '300')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ea0b85ac19a33d94 — Environment-variable access.
repo/backend/open_webui/env.py:653 
RAG_EMBEDDING_TIMEOUT = os.getenv('RAG_EMBEDDING_TIMEOUT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7500a0c19c54a16b — Environment-variable access.
repo/backend/open_webui/env.py:668 
WEBUI_AUTH = os.getenv('WEBUI_AUTH', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da31fa05c363ad14 — Environment-variable access.
repo/backend/open_webui/env.py:670 
ENABLE_INITIAL_ADMIN_SIGNUP = os.getenv('ENABLE_INITIAL_ADMIN_SIGNUP', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bf5f23bef4e23921 — Environment-variable access.
repo/backend/open_webui/env.py:671 
ENABLE_SIGNUP_PASSWORD_CONFIRMATION = os.getenv('ENABLE_SIGNUP_PASSWORD_CONFIRMATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6b47650d62f75309 — Environment-variable access.
repo/backend/open_webui/env.py:679 
WEBUI_SECRET_KEY = os.getenv(
    'WEBUI_SECRET_KEY',
    os.getenv('WEBUI_JWT_SECRET_KEY', ''),
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #57de80351a1d3227 — Environment-variable access.
repo/backend/open_webui/env.py:681 
    os.getenv('WEBUI_JWT_SECRET_KEY', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99df5a01d1fe9015 — Environment-variable access.
repo/backend/open_webui/env.py:684 
ENABLE_VALVE_ENCRYPTION = os.getenv('ENABLE_VALVE_ENCRYPTION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9c2b11a2a16933f — Environment-variable access.
repo/backend/open_webui/env.py:686 
WEBUI_SESSION_COOKIE_SAME_SITE = os.getenv('WEBUI_SESSION_COOKIE_SAME_SITE', 'lax')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #054633dbf58112ce — Environment-variable access.
repo/backend/open_webui/env.py:687 
WEBUI_SESSION_COOKIE_SECURE = os.getenv('WEBUI_SESSION_COOKIE_SECURE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4f560b1a9e34250 — Environment-variable access.
repo/backend/open_webui/env.py:688 
WEBUI_AUTH_COOKIE_SAME_SITE = os.getenv('WEBUI_AUTH_COOKIE_SAME_SITE', WEBUI_SESSION_COOKIE_SAME_SITE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #727b4abd57eadca1 — Environment-variable access.
repo/backend/open_webui/env.py:690 
    os.getenv(
        'WEBUI_AUTH_COOKIE_SECURE',
        os.getenv('WEBUI_SESSION_COOKIE_SECURE', 'false'),
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #441f109a584bebd5 — Environment-variable access.
repo/backend/open_webui/env.py:692 
        os.getenv('WEBUI_SESSION_COOKIE_SECURE', 'false'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d5379401a0786f92 — Environment-variable access.
repo/backend/open_webui/env.py:707 
ENABLE_COMPRESSION_MIDDLEWARE = os.getenv('ENABLE_COMPRESSION_MIDDLEWARE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #094525622d9c4615 — Environment-variable access.
repo/backend/open_webui/env.py:715 
WEBUI_ADMIN_EMAIL = os.getenv('WEBUI_ADMIN_EMAIL', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6e0f04bd217e5b0d — Environment-variable access.
repo/backend/open_webui/env.py:716 
WEBUI_ADMIN_PASSWORD = os.getenv('WEBUI_ADMIN_PASSWORD', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d71a0e1e94c05515 — Environment-variable access.
repo/backend/open_webui/env.py:717 
WEBUI_ADMIN_NAME = os.getenv('WEBUI_ADMIN_NAME', 'Admin')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6611733652d81a3b — Environment-variable access.
repo/backend/open_webui/env.py:719 
WEBUI_AUTH_TRUSTED_EMAIL_HEADER = os.getenv('WEBUI_AUTH_TRUSTED_EMAIL_HEADER', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c22b4328bcd610b9 — Environment-variable access.
repo/backend/open_webui/env.py:720 
WEBUI_AUTH_TRUSTED_NAME_HEADER = os.getenv('WEBUI_AUTH_TRUSTED_NAME_HEADER', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5cafd6a05107917e — Environment-variable access.
repo/backend/open_webui/env.py:721 
WEBUI_AUTH_TRUSTED_GROUPS_HEADER = os.getenv('WEBUI_AUTH_TRUSTED_GROUPS_HEADER', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39383252fa6dab20 — Environment-variable access.
repo/backend/open_webui/env.py:722 
WEBUI_AUTH_TRUSTED_ROLE_HEADER = os.getenv('WEBUI_AUTH_TRUSTED_ROLE_HEADER', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7015d6bd3dc39144 — Environment-variable access.
repo/backend/open_webui/env.py:729 
CUSTOM_API_KEY_HEADER = os.getenv('CUSTOM_API_KEY_HEADER', 'x-api-key')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94c194b8f5e92b62 — Environment-variable access.
repo/backend/open_webui/env.py:731 
ENABLE_PASSWORD_VALIDATION = os.getenv('ENABLE_PASSWORD_VALIDATION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc444b37099cf811 — Environment-variable access.
repo/backend/open_webui/env.py:732 
PASSWORD_HASH_ALGORITHM = os.getenv('PASSWORD_HASH_ALGORITHM', 'bcrypt').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #76361d04a17bf30b — Environment-variable access.
repo/backend/open_webui/env.py:733 
PASSWORD_VALIDATION_REGEX_PATTERN = os.getenv(
    'PASSWORD_VALIDATION_REGEX_PATTERN',
    r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$',
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c6120dcad0ee0396 — Environment-variable access.
repo/backend/open_webui/env.py:746 
PASSWORD_VALIDATION_HINT = os.getenv('PASSWORD_VALIDATION_HINT', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32d7032a1454281d — Environment-variable access.
repo/backend/open_webui/env.py:749 
BYPASS_MODEL_ACCESS_CONTROL = os.getenv('BYPASS_MODEL_ACCESS_CONTROL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4664cc783793e8a9 — Environment-variable access.
repo/backend/open_webui/env.py:750 
BYPASS_RETRIEVAL_ACCESS_CONTROL = os.getenv('BYPASS_RETRIEVAL_ACCESS_CONTROL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d30ae072fb84d021 — Environment-variable access.
repo/backend/open_webui/env.py:756 
ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS = os.getenv('ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d69a7534a74b852e — Environment-variable access.
repo/backend/open_webui/env.py:758 
    int(os.getenv('MINERU_MAX_MARKDOWN_BYTES')) if os.getenv('MINERU_MAX_MARKDOWN_BYTES') else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b819e564b9d6cdb5 — Environment-variable access.
repo/backend/open_webui/env.py:764 
BYPASS_PYDUB_PREPROCESSING = os.getenv('BYPASS_PYDUB_PREPROCESSING', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d1b2c439f823947 — Environment-variable access.
repo/backend/open_webui/env.py:769 
ENABLE_OPENAI_API_PASSTHROUGH = os.getenv('ENABLE_OPENAI_API_PASSTHROUGH', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db757ea3566183a0 — Environment-variable access.
repo/backend/open_webui/env.py:771 
WEBUI_AUTH_SIGNOUT_REDIRECT_URL = os.getenv('WEBUI_AUTH_SIGNOUT_REDIRECT_URL', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71e743c9c4bf5c7f — Environment-variable access.
repo/backend/open_webui/env.py:776 
ENABLE_OAUTH_EMAIL_FALLBACK = os.getenv('ENABLE_OAUTH_EMAIL_FALLBACK', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cead6e3e1e819737 — Environment-variable access.
repo/backend/open_webui/env.py:778 
ENABLE_OAUTH_ID_TOKEN_COOKIE = os.getenv('ENABLE_OAUTH_ID_TOKEN_COOKIE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe270b5e94144a02 — Environment-variable access.
repo/backend/open_webui/env.py:780 
OAUTH_CLIENT_INFO_ENCRYPTION_KEY = os.getenv('OAUTH_CLIENT_INFO_ENCRYPTION_KEY', WEBUI_SECRET_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #356855c530bc19eb — Environment-variable access.
repo/backend/open_webui/env.py:782 
OAUTH_SESSION_TOKEN_ENCRYPTION_KEY = os.getenv('OAUTH_SESSION_TOKEN_ENCRYPTION_KEY', WEBUI_SECRET_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #82c314a35c095d9b — Environment-variable access.
repo/backend/open_webui/env.py:786 
OAUTH_MAX_SESSIONS_PER_USER = int(os.getenv('OAUTH_MAX_SESSIONS_PER_USER', '10'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0964ca194bda7928 — Environment-variable access.
repo/backend/open_webui/env.py:790 
ENABLE_OAUTH_TOKEN_EXCHANGE = os.getenv('ENABLE_OAUTH_TOKEN_EXCHANGE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9a233e5b7f0529d5 — Environment-variable access.
repo/backend/open_webui/env.py:796 
ENABLE_OAUTH_BACKCHANNEL_LOGOUT = os.getenv('ENABLE_OAUTH_BACKCHANNEL_LOGOUT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4de5d5ed44f93ddd — Environment-variable access.
repo/backend/open_webui/env.py:802 
ENABLE_SCIM = os.getenv('ENABLE_SCIM', os.getenv('SCIM_ENABLED', 'False')).lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dd284a80e47c5a65 — Environment-variable access.
repo/backend/open_webui/env.py:803 
SCIM_TOKEN = os.getenv('SCIM_TOKEN', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #84be1162dff341a9 — Environment-variable access.
repo/backend/open_webui/env.py:804 
SCIM_AUTH_PROVIDER = os.getenv('SCIM_AUTH_PROVIDER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #91f2186533fb82c0 — Environment-variable access.
repo/backend/open_webui/env.py:817 
LICENSE_KEY = os.getenv('LICENSE_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07840628371210b9 — Environment-variable access.
repo/backend/open_webui/env.py:820 
LICENSE_BLOB_PATH = os.getenv('LICENSE_BLOB_PATH', DATA_DIR / 'l.data')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b8c6bebbc00f29f — Filesystem access.
repo/backend/open_webui/env.py:822 
    with open(LICENSE_BLOB_PATH, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b298f6d4025893ac — Environment-variable access.
repo/backend/open_webui/env.py:825 
LICENSE_PUBLIC_KEY = os.getenv('LICENSE_PUBLIC_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b0cae69c7a35d681 — Environment-variable access.
repo/backend/open_webui/env.py:842 
WEBUI_NAME = os.getenv('WEBUI_NAME', 'Open WebUI')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4cf6fcada0b23a61 — Environment-variable access.
repo/backend/open_webui/env.py:847 
WEBUI_BUILD_HASH = os.getenv('WEBUI_BUILD_HASH', 'dev-build')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3324385a0ad660f — Environment-variable access.
repo/backend/open_webui/env.py:848 
TRUSTED_SIGNATURE_KEY = os.getenv('TRUSTED_SIGNATURE_KEY', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de849d3668343411 — Environment-variable access.
repo/backend/open_webui/env.py:854 
SAFE_MODE = os.getenv('SAFE_MODE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f645c564e69ec7d1 — Environment-variable access.
repo/backend/open_webui/env.py:855 
ENABLE_EASTER_EGGS = os.getenv('ENABLE_EASTER_EGGS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a65077062193c64d — Environment-variable access.
repo/backend/open_webui/env.py:856 
ENABLE_STAR_SESSIONS_MIDDLEWARE = os.getenv('ENABLE_STAR_SESSIONS_MIDDLEWARE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77912a1364074b11 — Environment-variable access.
repo/backend/open_webui/env.py:857 
ENABLE_KB_EXEC = os.getenv('ENABLE_KB_EXEC', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fdea03d9e1387233 — Environment-variable access.
repo/backend/open_webui/env.py:859 
ENABLE_PROFILE_IMAGE_URL_FORWARDING = os.getenv('ENABLE_PROFILE_IMAGE_URL_FORWARDING', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #25b65ccaf3a7c2e0 — Environment-variable access.
repo/backend/open_webui/env.py:862 
    for t in os.getenv(
        'PROFILE_IMAGE_ALLOWED_MIME_TYPES',
        'image/png,image/jpeg,image/gif,image/webp',
    ).split(',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b8f55dead1e5b15b — Environment-variable access.
repo/backend/open_webui/env.py:871 
_profile_image_max_data_uri_size = os.getenv('PROFILE_IMAGE_MAX_DATA_URI_SIZE', '').strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e314be0e2c25b5ac — Environment-variable access.
repo/backend/open_webui/env.py:878 
ENABLE_FORWARD_USER_INFO_HEADERS = os.getenv('ENABLE_FORWARD_USER_INFO_HEADERS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dbdf2f50ad001466 — Environment-variable access.
repo/backend/open_webui/env.py:880 
FORWARD_USER_INFO_HEADER_USER_NAME = os.getenv('FORWARD_USER_INFO_HEADER_USER_NAME', 'X-OpenWebUI-User-Name')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #91b2b7b644b3c26f — Environment-variable access.
repo/backend/open_webui/env.py:881 
FORWARD_USER_INFO_HEADER_USER_ID = os.getenv('FORWARD_USER_INFO_HEADER_USER_ID', 'X-OpenWebUI-User-Id')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef9f0d7825ebd3ad — Environment-variable access.
repo/backend/open_webui/env.py:882 
FORWARD_USER_INFO_HEADER_USER_EMAIL = os.getenv('FORWARD_USER_INFO_HEADER_USER_EMAIL', 'X-OpenWebUI-User-Email')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a874272e7df2d48f — Environment-variable access.
repo/backend/open_webui/env.py:883 
FORWARD_USER_INFO_HEADER_USER_ROLE = os.getenv('FORWARD_USER_INFO_HEADER_USER_ROLE', 'X-OpenWebUI-User-Role')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #701416d7c8303b27 — Environment-variable access.
repo/backend/open_webui/env.py:884 
FORWARD_SESSION_INFO_HEADER_MESSAGE_ID = os.getenv('FORWARD_SESSION_INFO_HEADER_MESSAGE_ID', 'X-OpenWebUI-Message-Id')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #033f3151dc58ecf4 — Environment-variable access.
repo/backend/open_webui/env.py:885 
FORWARD_SESSION_INFO_HEADER_CHAT_ID = os.getenv('FORWARD_SESSION_INFO_HEADER_CHAT_ID', 'X-OpenWebUI-Chat-Id')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d45739558fad96f4 — Environment-variable access.
repo/backend/open_webui/env.py:889 
FORWARD_USER_INFO_HEADER_JWT_SECRET = (os.environ.get('FORWARD_USER_INFO_HEADER_JWT_SECRET') or '').strip() or None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83bbba51654e6df3 — Environment-variable access.
repo/backend/open_webui/env.py:890 
FORWARD_USER_INFO_HEADER_JWT = os.environ.get('FORWARD_USER_INFO_HEADER_JWT', 'X-OpenWebUI-User-Jwt')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #89ed9225fac7f147 — Environment-variable access.
repo/backend/open_webui/env.py:893 
        os.environ.get('FORWARD_USER_INFO_HEADER_JWT_EXPIRES_SECONDS', '300')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7684a93d4868374e — Environment-variable access.
repo/backend/open_webui/env.py:902 
EXTERNAL_PWA_MANIFEST_URL = os.getenv('EXTERNAL_PWA_MANIFEST_URL', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0010cbfa39e33fa6 — Environment-variable access.
repo/backend/open_webui/env.py:910 
_default_group_share = os.getenv('DEFAULT_GROUP_SHARE_PERMISSION', 'members').strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #951b516fcbad7354 — Environment-variable access.
repo/backend/open_webui/env.py:917 
ENABLE_CUSTOM_MODEL_FALLBACK = os.getenv('ENABLE_CUSTOM_MODEL_FALLBACK', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3fa8b8e5430bed6 — Environment-variable access.
repo/backend/open_webui/env.py:919 
MODELS_CACHE_TTL = os.getenv('MODELS_CACHE_TTL', '1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a8f1be22cf7cbe13 — Environment-variable access.
repo/backend/open_webui/env.py:934 
    os.getenv('ENABLE_CHAT_RESPONSE_BASE64_IMAGE_URL_CONVERSION', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #434b4475b73ca3ff — Environment-variable access.
repo/backend/open_webui/env.py:936 
ENABLE_API_OUTLET_FILTERS = os.getenv('ENABLE_API_OUTLET_FILTERS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b4df820608c4f2bd — Environment-variable access.
repo/backend/open_webui/env.py:944 
    os.getenv('ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d2c4278f8b7429d — Environment-variable access.
repo/backend/open_webui/env.py:947 
CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE = os.getenv('CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE', '1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6da5157d354470b0 — Environment-variable access.
repo/backend/open_webui/env.py:960 
CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS = os.getenv(
    'CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS',
    os.getenv('CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES', '256'),
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af9357379057fe2a — Environment-variable access.
repo/backend/open_webui/env.py:962 
    os.getenv('CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES', '256'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0af2420880ad3d82 — Environment-variable access.
repo/backend/open_webui/env.py:982 
ENABLE_RESPONSES_API_STATEFUL = os.getenv('ENABLE_RESPONSES_API_STATEFUL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fbe8288cde65f877 — Environment-variable access.
repo/backend/open_webui/env.py:985 
CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE = os.getenv('CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aedeb86f2a253feb — Environment-variable access.
repo/backend/open_webui/env.py:1001 
SENTENCE_TRANSFORMERS_BACKEND = os.getenv('SENTENCE_TRANSFORMERS_BACKEND', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5026ba2a1c5117d0 — Environment-variable access.
repo/backend/open_webui/env.py:1006 
SENTENCE_TRANSFORMERS_MODEL_KWARGS = os.getenv('SENTENCE_TRANSFORMERS_MODEL_KWARGS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #03c6d87eb4f7b6b5 — Environment-variable access.
repo/backend/open_webui/env.py:1016 
SENTENCE_TRANSFORMERS_CROSS_ENCODER_BACKEND = os.getenv('SENTENCE_TRANSFORMERS_CROSS_ENCODER_BACKEND', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e973157d0f8e07d — Environment-variable access.
repo/backend/open_webui/env.py:1021 
SENTENCE_TRANSFORMERS_CROSS_ENCODER_MODEL_KWARGS = os.getenv('SENTENCE_TRANSFORMERS_CROSS_ENCODER_MODEL_KWARGS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c438fda4f10d265 — Environment-variable access.
repo/backend/open_webui/env.py:1034 
    os.getenv('SENTENCE_TRANSFORMERS_CROSS_ENCODER_SIGMOID_ACTIVATION_FUNCTION', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f2858fcfb4ea258 — Environment-variable access.
repo/backend/open_webui/env.py:1042 
    os.getenv('ENABLE_PIP_INSTALL_FRONTMATTER_REQUIREMENTS', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6e1009bf1de47407 — Environment-variable access.
repo/backend/open_webui/env.py:1045 
PIP_OPTIONS = os.getenv('PIP_OPTIONS', '').split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #87819c42d7f163b2 — Environment-variable access.
repo/backend/open_webui/env.py:1046 
PIP_PACKAGE_INDEX_OPTIONS = os.getenv('PIP_PACKAGE_INDEX_OPTIONS', '').split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4cc073d4a6b32af0 — Environment-variable access.
repo/backend/open_webui/env.py:1053 
ENABLE_VERSION_UPDATE_CHECK = os.getenv('ENABLE_VERSION_UPDATE_CHECK', 'true').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6593adda1734440d — Environment-variable access.
repo/backend/open_webui/env.py:1054 
OFFLINE_MODE = os.getenv('OFFLINE_MODE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4c8672e185381fb2 — Environment-variable access.
repo/backend/open_webui/env.py:1057 
    os.environ['HF_HUB_OFFLINE'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #689c1acfb6eaa05e — Environment-variable access.
repo/backend/open_webui/env.py:1064 
ENABLE_PYODIDE_FILE_PERSISTENCE = os.getenv('ENABLE_PYODIDE_FILE_PERSISTENCE', 'false').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9881299d91c12a7c — Environment-variable access.
repo/backend/open_webui/env.py:1071 
ENABLE_AUDIT_STDOUT = os.getenv('ENABLE_AUDIT_STDOUT', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c9a0e46c85613ff — Environment-variable access.
repo/backend/open_webui/env.py:1072 
ENABLE_AUDIT_LOGS_FILE = os.getenv('ENABLE_AUDIT_LOGS_FILE', 'True').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7aaee356976797a4 — Environment-variable access.
repo/backend/open_webui/env.py:1077 
AUDIT_LOGS_FILE_PATH = os.getenv('AUDIT_LOGS_FILE_PATH', f'{DATA_DIR}/audit.log')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40be78d9e2c75be2 — Environment-variable access.
repo/backend/open_webui/env.py:1079 
AUDIT_LOG_FILE_ROTATION_SIZE = os.getenv('AUDIT_LOG_FILE_ROTATION_SIZE', '10MB')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3fe222ba104ded0b — Environment-variable access.
repo/backend/open_webui/env.py:1084 
AUDIT_UVICORN_LOGGER_NAMES = os.getenv('AUDIT_UVICORN_LOGGER_NAMES', 'uvicorn.access').split(',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #743e297871b0fede — Environment-variable access.
repo/backend/open_webui/env.py:1087 
AUDIT_LOG_LEVEL = os.getenv('AUDIT_LOG_LEVEL', 'NONE').upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93344479b55777ee — Environment-variable access.
repo/backend/open_webui/env.py:1089 
    MAX_BODY_LOG_SIZE = int(os.getenv('MAX_BODY_LOG_SIZE') or 2048)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ccd9fbd79e59f953 — Environment-variable access.
repo/backend/open_webui/env.py:1094 
AUDIT_EXCLUDED_PATHS = os.getenv('AUDIT_EXCLUDED_PATHS', '/chats,/chat,/folders').split(',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4d6835a93c005d8d — Environment-variable access.
repo/backend/open_webui/env.py:1100 
AUDIT_INCLUDED_PATHS = os.getenv('AUDIT_INCLUDED_PATHS', '').split(',')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5dd1705911e6c534 — Environment-variable access.
repo/backend/open_webui/env.py:1105 
ENABLE_AUDIT_GET_REQUESTS = os.getenv('ENABLE_AUDIT_GET_REQUESTS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #316d4d478a9407ad — Environment-variable access.
repo/backend/open_webui/env.py:1112 
ENABLE_OTEL = os.getenv('ENABLE_OTEL', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65bbfd6031fb6852 — Environment-variable access.
repo/backend/open_webui/env.py:1113 
ENABLE_OTEL_TRACES = os.getenv('ENABLE_OTEL_TRACES', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6c409bf568c3b14c — Environment-variable access.
repo/backend/open_webui/env.py:1114 
ENABLE_OTEL_METRICS = os.getenv('ENABLE_OTEL_METRICS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #696a7fdc78119286 — Environment-variable access.
repo/backend/open_webui/env.py:1115 
ENABLE_OTEL_LOGS = os.getenv('ENABLE_OTEL_LOGS', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a61416a5edd2aef0 — Environment-variable access.
repo/backend/open_webui/env.py:1117 
OTEL_EXPORTER_OTLP_ENDPOINT = os.getenv('OTEL_EXPORTER_OTLP_ENDPOINT', 'http://localhost:4317')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9f4ccf86e5522ae — Environment-variable access.
repo/backend/open_webui/env.py:1118 
OTEL_METRICS_EXPORTER_OTLP_ENDPOINT = os.getenv('OTEL_METRICS_EXPORTER_OTLP_ENDPOINT', OTEL_EXPORTER_OTLP_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #117bf2ffb17d746f — Environment-variable access.
repo/backend/open_webui/env.py:1119 
OTEL_LOGS_EXPORTER_OTLP_ENDPOINT = os.getenv('OTEL_LOGS_EXPORTER_OTLP_ENDPOINT', OTEL_EXPORTER_OTLP_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3eb5c166a493d446 — Environment-variable access.
repo/backend/open_webui/env.py:1120 
OTEL_EXPORTER_OTLP_INSECURE = os.getenv('OTEL_EXPORTER_OTLP_INSECURE', 'False').lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07cce5df9a6d37bc — Environment-variable access.
repo/backend/open_webui/env.py:1122 
    os.getenv('OTEL_METRICS_EXPORTER_OTLP_INSECURE', str(OTEL_EXPORTER_OTLP_INSECURE)).lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b500986411df0c1 — Environment-variable access.
repo/backend/open_webui/env.py:1125 
    os.getenv('OTEL_LOGS_EXPORTER_OTLP_INSECURE', str(OTEL_EXPORTER_OTLP_INSECURE)).lower() == 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69b2bd3f3afb81f9 — Environment-variable access.
repo/backend/open_webui/env.py:1127 
OTEL_SERVICE_NAME = os.getenv('OTEL_SERVICE_NAME', 'open-webui')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #efbb3aa9c33f4010 — Environment-variable access.
repo/backend/open_webui/env.py:1128 
OTEL_RESOURCE_ATTRIBUTES = os.getenv('OTEL_RESOURCE_ATTRIBUTES', '')  # e.g. key1=val1,key2=val2

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2567050067aef7b — Environment-variable access.
repo/backend/open_webui/env.py:1129 
OTEL_TRACES_SAMPLER = os.getenv('OTEL_TRACES_SAMPLER', 'parentbased_always_on').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5123ef9b320464fb — Environment-variable access.
repo/backend/open_webui/env.py:1130 
OTEL_BASIC_AUTH_USERNAME = os.getenv('OTEL_BASIC_AUTH_USERNAME', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ffb62907597043ff — Environment-variable access.
repo/backend/open_webui/env.py:1131 
OTEL_BASIC_AUTH_PASSWORD = os.getenv('OTEL_BASIC_AUTH_PASSWORD', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #95731fa3ade6de48 — Environment-variable access.
repo/backend/open_webui/env.py:1132 
OTEL_METRICS_EXPORT_INTERVAL_MILLIS = int(os.getenv('OTEL_METRICS_EXPORT_INTERVAL_MILLIS', '10000'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #712bb58747214d4e — Environment-variable access.
repo/backend/open_webui/env.py:1134 
OTEL_METRICS_BASIC_AUTH_USERNAME = os.getenv('OTEL_METRICS_BASIC_AUTH_USERNAME', OTEL_BASIC_AUTH_USERNAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e62b2efc281ceda6 — Environment-variable access.
repo/backend/open_webui/env.py:1135 
OTEL_METRICS_BASIC_AUTH_PASSWORD = os.getenv('OTEL_METRICS_BASIC_AUTH_PASSWORD', OTEL_BASIC_AUTH_PASSWORD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a5ac64fabdafa4a — Environment-variable access.
repo/backend/open_webui/env.py:1136 
OTEL_LOGS_BASIC_AUTH_USERNAME = os.getenv('OTEL_LOGS_BASIC_AUTH_USERNAME', OTEL_BASIC_AUTH_USERNAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4b18b8d64756aa1c — Environment-variable access.
repo/backend/open_webui/env.py:1137 
OTEL_LOGS_BASIC_AUTH_PASSWORD = os.getenv('OTEL_LOGS_BASIC_AUTH_PASSWORD', OTEL_BASIC_AUTH_PASSWORD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7dc84602d7aafc24 — Environment-variable access.
repo/backend/open_webui/env.py:1139 
OTEL_OTLP_SPAN_EXPORTER = os.getenv('OTEL_OTLP_SPAN_EXPORTER', 'grpc').lower()  # grpc or http

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c5c3302286ee4c8 — Environment-variable access.
repo/backend/open_webui/env.py:1141 
OTEL_METRICS_OTLP_SPAN_EXPORTER = os.getenv(
    'OTEL_METRICS_OTLP_SPAN_EXPORTER', OTEL_OTLP_SPAN_EXPORTER
).lower()  # grpc or http

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c96cbc2366419981 — Environment-variable access.
repo/backend/open_webui/env.py:1145 
OTEL_LOGS_OTLP_SPAN_EXPORTER = os.getenv(
    'OTEL_LOGS_OTLP_SPAN_EXPORTER', OTEL_OTLP_SPAN_EXPORTER
).lower()  # grpc or http

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7d25e2faf9cb1d0a — Environment-variable access.
repo/backend/open_webui/internal/db.py:242 
    database_password = os.environ.get('DATABASE_PASSWORD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ffb84b935d7a20f — Filesystem access.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:110 
            with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b9b6116d8bb1bae9 — Filesystem access.
repo/backend/open_webui/retrieval/loaders/datalab_marker.py:235 
            with open(output_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dbf0a53a9ff74f95 — Filesystem access.
repo/backend/open_webui/retrieval/loaders/external_document.py:37 
        with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7df94068a69ce5bb — Filesystem access.
repo/backend/open_webui/retrieval/loaders/main.py:149 
        with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb1b3b07035c2c70 — Filesystem access.
repo/backend/open_webui/retrieval/loaders/main.py:192 
        with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a6625b7c86d6f2bd — Filesystem access.
repo/backend/open_webui/retrieval/loaders/main.py:294 
            with open(file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ab0e72f87c7c94a — Filesystem access.
repo/backend/open_webui/retrieval/loaders/mineru.py:97 
            with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #649fec9f4b5fc8ae — Filesystem access.
repo/backend/open_webui/retrieval/loaders/mineru.py:298 
            with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #70e708f92f0a6412 — Filesystem access.
repo/backend/open_webui/retrieval/loaders/mistral.py:235 
            with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0a562100d734e1e — Filesystem access.
repo/backend/open_webui/retrieval/loaders/mistral.py:270 
            with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39f93f658741aa11 — Filesystem access.
repo/backend/open_webui/retrieval/loaders/mistral.py:424 
        with open(self.file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3cd71fbcae8634b0 — Filesystem access.
repo/backend/open_webui/retrieval/loaders/paddleocr_vl.py:38 
            with open(self.file_path, 'rb') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b7735d194ec39c6 — Environment-variable access.
repo/backend/open_webui/retrieval/utils.py:1623 
    cache_dir = os.getenv('SENTENCE_TRANSFORMERS_HOME')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3037f9232b84ed1b — Environment-variable access.
repo/backend/open_webui/retrieval/web/bing.py:68 
        os.environ.get('BING_SEARCH_V7_SUBSCRIPTION_KEY', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #58fc7648c4841b8b — Environment-variable access.
repo/backend/open_webui/retrieval/web/bing.py:69 
        os.environ.get('BING_SEARCH_V7_ENDPOINT', 'https://api.bing.microsoft.com/v7.0/search'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #71dd684b26bdeadc — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/bocha.py:46 
    response = requests.post(url, headers=headers, data=payload, timeout=5)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4dac21266bc1c6b8 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/brave_llm_context.py:44 
    response = requests.get(url, headers=headers, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c1d6910b4080e6f7 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/brave_llm_context.py:50 
        response = requests.get(url, headers=headers, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c7d1a151e74178c8 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/exa.py:47 
        response = requests.post(f'{EXA_API_BASE}/search', headers=headers, json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8c198fc3307bc752 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/kagi.py:26 
    response = requests.post(url, headers=headers, json=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #173d0d23050410ea — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/mojeek.py:24 
    response = requests.get(url, headers=headers, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a2383518257ff63e — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/tavily.py:34 
    response = requests.post(url, headers=headers, json=data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #5feaeee637bb2136 — Environment-variable access.
repo/backend/open_webui/retrieval/web/yandex.py:142 
        os.environ.get('YANDEX_WEB_SEARCH_URL', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aebc1fd9a1c735c1 — Environment-variable access.
repo/backend/open_webui/retrieval/web/yandex.py:143 
        os.environ.get('YANDEX_WEB_SEARCH_API_KEY', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0f5194aa7d7080e — Environment-variable access.
repo/backend/open_webui/retrieval/web/yandex.py:144 
        os.environ.get('YANDEX_WEB_SEARCH_CONFIG', '{"query": {"searchType": "SEARCH_TYPE_COM"}}'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #9e0d575ad3ec88d2 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/backend/open_webui/retrieval/web/ydc.py:37 
    response = requests.get(url, headers=headers, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #0871aeb3964763cd — Filesystem access.
repo/backend/open_webui/routers/audio.py:681 
                with open(file_path, 'rb') as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7543c47ee571e454 — Filesystem access.
repo/backend/open_webui/routers/audio.py:828 
    form_data.add_field('audio', open(file_path, 'rb'), filename=filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f69486ca956df14f — Filesystem access.
repo/backend/open_webui/routers/audio.py:1005 
            form_data.add_field('file', open(file_path, 'rb'), filename=filename, content_type=mime_type)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0aa221260576660b — Filesystem access.
repo/backend/open_webui/routers/audio.py:1212 
            with open(file_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bcbb55a81ef2fe07 — Environment-variable access.
repo/backend/open_webui/routers/evaluations.py:65 
EMBEDDING_MODEL_NAME = os.environ.get('AUXILIARY_EMBEDDING_MODEL', 'TaylorAI/bge-micro-v2')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c657488689146529 — Filesystem access.
repo/backend/open_webui/routers/files.py:78 
        with open(resolved, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cc1146d9a934c711 — Filesystem access.
repo/backend/open_webui/routers/images.py:939 
                    with open(file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #78859e9e4364d952 — Filesystem access.
repo/backend/open_webui/routers/ollama.py:1480 
        with open(file_path, 'ab+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36976e2575b4bfd7 — Filesystem access.
repo/backend/open_webui/routers/ollama.py:1494 
                    with open(file_path, 'rb') as blob_f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #860fc729e6d273ff — Filesystem access.
repo/backend/open_webui/routers/ollama.py:1560 
        with open(file_path, 'wb') as out_f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #59123a93b837f9cf — Filesystem access.
repo/backend/open_webui/routers/ollama.py:1579 
            with open(file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37608d893547744f — Filesystem access.
repo/backend/open_webui/routers/ollama.py:1588 
                with open(file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3d494f2c19a3a8c9 — Filesystem access.
repo/backend/open_webui/routers/openai.py:400 
            with open(file_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b9f6ce2528ca6e1 — Filesystem access.
repo/backend/open_webui/routers/openai.py:404 
            with open(file_body_path, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #105f24d8c1925ab7 — Filesystem access.
repo/backend/open_webui/routers/pipelines.py:242 
            with open(file_path, 'wb') as buffer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2780e50e1480bff — Filesystem access.
repo/backend/open_webui/routers/pipelines.py:252 
            with open(file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ea0ebfdb4b08ea1a — Environment-variable access.
repo/backend/open_webui/routers/retrieval.py:1567 
            cache_dir=os.getenv('SENTENCE_TRANSFORMERS_HOME') or os.getenv('HF_HUB_CACHE'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54db2657de6aebdd — Filesystem access.
repo/backend/open_webui/storage/provider.py:65 
        with open(file_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #14ac9651481e8f56 — Filesystem access.
repo/backend/open_webui/storage/provider.py:303 
            with open(local_file_path, 'wb') as download_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c828af58399658ce — Filesystem access.
repo/backend/open_webui/utils/auth.py:81 
    with open(file_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #95eb2bdcc0409c2c — Environment-variable access.
repo/backend/open_webui/utils/automations.py:43 
SCHEDULER_POLL_INTERVAL = int(os.getenv('SCHEDULER_POLL_INTERVAL', os.getenv('AUTOMATION_POLL_INTERVAL', '10')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #82a985c24a721480 — Environment-variable access.
repo/backend/open_webui/utils/automations.py:44 
CALENDAR_ALERT_LOOKAHEAD_MINUTES = int(os.getenv('CALENDAR_ALERT_LOOKAHEAD_MINUTES', '10'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5d142896db614c1d — Filesystem access.
repo/backend/open_webui/utils/files.py:203 
            with open(file_path, 'rb') as image_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #010c9324f0c7b69f — Filesystem access.
repo/backend/open_webui/utils/misc.py:678 
    with open(file_path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b1427378d49d4e6a — Filesystem access.
repo/backend/open_webui/utils/pdf_generator.py:30 
        self.css = Path(STATIC_DIR / 'assets' / 'pdf-style.css').read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4e088922ec58225 — Filesystem access.
repo/backend/open_webui/utils/plugin.py:231 
        with open(temp_file.name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #15bb420ae251abfb — Filesystem access.
repo/backend/open_webui/utils/plugin.py:276 
        with open(temp_file.name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c2d1513e9d6a7af4 — Environment-variable access.
repo/backend/open_webui/utils/security_headers.py:63 
        value = os.environ.get(env_var, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #84623f47f96739e9 — Filesystem access.
repo/contribution_stats.py:11 
        with open(filepath, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7674221dc3326703 — Environment-variable access.
repo/hatch_build.py:20 
        os.environ['APP_BUILD_HASH'] = version

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (python): backend/open_webui/utils/telemetry

python first-party
medium telemetry production #39d254156e01fb8c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/constants.py:1 
from opentelemetry.semconv._incubating.attributes import (
    db_attributes as _db,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #d04372e202f37dcf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/constants.py:4 
from opentelemetry.semconv._incubating.attributes import (
    http_attributes as _http,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #dd878b31da6b1496 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:12 
from opentelemetry.instrumentation.aiohttp_client import AioHttpClientInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #a4fdb0b5b763474f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:13 
from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #43de1d93b0e78dff — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:14 
from opentelemetry.instrumentation.httpx import (
    HTTPXClientInstrumentor,
    RequestInfo,
    ResponseInfo,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #de4a0afb05e0fe55 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:19 
from opentelemetry.instrumentation.instrumentor import BaseInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #c07888f11f1a17b4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:20 
from opentelemetry.instrumentation.logging import LoggingInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #feaf75cb664ded85 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:21 
from opentelemetry.instrumentation.redis import RedisInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #06ad233ee5158dd1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:22 
from opentelemetry.instrumentation.requests import RequestsInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #384f580dae8a206e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:23 
from opentelemetry.instrumentation.sqlalchemy import SQLAlchemyInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #bf01bfd33647b496 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:24 
from opentelemetry.instrumentation.system_metrics import SystemMetricsInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #73c5304e27516fb0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/instrumentors.py:25 
from opentelemetry.trace import Span, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #6725cccbe76cebdd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/logs.py:12 
from opentelemetry._logs import set_logger_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #1e670034bfb6acef — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/logs.py:13 
from opentelemetry.exporter.otlp.proto.grpc._log_exporter import OTLPLogExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #cabc32787f87fbf5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/logs.py:14 
from opentelemetry.exporter.otlp.proto.http._log_exporter import (
    OTLPLogExporter as HttpOTLPLogExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #9cb7496d576dc434 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/logs.py:17 
from opentelemetry.sdk._logs import (
    LoggerProvider,
    LoggingHandler,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #a0ef652a7110374a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/logs.py:21 
from opentelemetry.sdk._logs.export import BatchLogRecordProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #9ea14f12dd17b1c8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/logs.py:22 
from opentelemetry.sdk.resources import SERVICE_NAME, Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #e482a1a01dd6263d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/metrics.py:37 
from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #623d892b3487828e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/metrics.py:38 
from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import (
    OTLPMetricExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #f51bc150c58f86e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/metrics.py:41 
from opentelemetry.exporter.otlp.proto.http.metric_exporter import (
    OTLPMetricExporter as OTLPHttpMetricExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #68dfcec60756df66 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/metrics.py:44 
from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #772b78050eedb1f2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/metrics.py:45 
from opentelemetry.sdk.metrics.export import (
    PeriodicExportingMetricReader,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #2fdce97ad7d41980 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/metrics.py:48 
from opentelemetry.sdk.metrics.view import View

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #87407b0c2ca2d1e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/metrics.py:49 
from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #0ad9d91504e94f86 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/setup.py:16 
from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #82d38c206433d685 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/setup.py:17 
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #e73d33839988892a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/setup.py:18 
from opentelemetry.exporter.otlp.proto.http.trace_exporter import (
    OTLPSpanExporter as HttpOTLPSpanExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #c9719e58236035c1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/setup.py:21 
from opentelemetry.sdk.resources import SERVICE_NAME, Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #a2b24aa7dc5a3cff — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/setup.py:22 
from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #d85c0f8e0efede5e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/backend/open_webui/utils/telemetry/setup.py:23 
from opentelemetry.sdk.trace.export import BatchSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

</> Dependencies

transformers

python dependency
high pii_flow dependency Excluded from app score #941d98b9c29d9063 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2493 · flow /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2466 → /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2493 
            req = urllib.request.Request(url, data=data, headers=headers, method="POST")

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow dependency Excluded from app score #dca407bfbc582272 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2494 · flow /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2466 → /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2494 
            with urllib.request.urlopen(req, timeout=5, context=self._get_ssl_context()) as resp:

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow dependency Excluded from app score #d103fb5a9e575c2d — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/transformers/utils/hub.py:163 · flow /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/transformers/utils/hub.py:163 → /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/transformers/utils/hub.py:163 
        instance_data = httpx.get(os.environ["ECS_CONTAINER_METADATA_URI"]).json()

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
medium telemetry dependency Excluded from app score #88f77372aa4de824 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/transformers/utils/metrics.py:24 
    from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #894f64bc5b590eb6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/transformers/utils/metrics.py:25 
    from opentelemetry.trace import Status, StatusCode, get_tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 374 low-confidence finding(s)
low env_fs dependency Excluded from app score #b4efd124e24af3ba — Filesystem access.
pkgs/python/[email protected]/setup.py:310 
        with open(target, "w", encoding="utf-8", newline="\n") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c171a5dc5ba0fb00 — Filesystem access.
pkgs/python/[email protected]/setup.py:330 
        long_description=open("README.md", "r", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de0e4699c5cacc67 — Filesystem access.
pkgs/python/[email protected]/src/transformers/audio_utils.py:182 
            with open(audio, "rb") as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #968f3d184b7033fc — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:168 
    with open(file_name, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8adb9dac46fb1f33 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:174 
    with open(file_name, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36122f033b324015 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:230 
            file = (repo_path / "src" / "transformers" / "models" / "auto" / filename).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d51a0eebb8bf126 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:316 
    with open(toc_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb22eb77c84e6800 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:372 
    with open(module_name, "r", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6b40b6a40a50c4e — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:497 
            with open(original_test_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6455ccaf40043863 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:547 
    with open(new_module_folder / f"modular_{new_lowercase_name}.py", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a99918e01d6b95bf — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:552 
    with open(new_module_folder / "__init__.py", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67851844e379dc88 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:569 
    with open(tests_folder / "__init__.py", "w"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ea62036cff9fe04 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:573 
        with open(tests_folder / filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c087f2a80fc97dc — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:578 
    with open(repo_path / "docs" / "source" / "en" / "model_doc" / f"{new_lowercase_name}.md", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7124e15989b86120 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/chat.py:361 
            with open(examples_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1b8c05ac237a874 — Filesystem access.
pkgs/python/[email protected]/src/transformers/cli/chat.py:657 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68287cca8a759280 — Filesystem access.
pkgs/python/[email protected]/src/transformers/configuration_utils.py:870 
        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3427cbb9cada9c0a — Filesystem access.
pkgs/python/[email protected]/src/transformers/configuration_utils.py:1071 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d17d9aebbb6eccb — Filesystem access.
pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:159 
        with open(model, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cd3b1c41b8c3f13 — Filesystem access.
pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:706 
        with open(self.original_tokenizer.vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebf561549f7d9556 — Filesystem access.
pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:1708 
        with open(vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #297d6ddf3f0e4fc6 — Filesystem access.
pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:1748 
        with open(vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #673abed7300c2c59 — Filesystem access.
pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:1838 
        with open(vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #041e88d02d38394c — Filesystem access.
pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:1998 
        with open(self.vocab_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8c69d8791ca7b65 — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:576 
        with open(output_prediction_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f05dc6074e803aa0 — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:580 
        with open(output_nbest_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #064760ae94bc89b2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:584 
        with open(output_null_log_odds_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #020a8495bce17185 — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:769 
    with open(output_prediction_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9940f4da5742e75b — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:772 
    with open(output_nbest_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65e746cc7c4b13e2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:776 
        with open(output_null_log_odds_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19820095f951c956 — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/processors/squad.py:515 
        with open(
            os.path.join(data_dir, self.train_file if filename is None else filename), "r", encoding="utf-8"
        ) as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c29b04a3246bd542 — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/processors/squad.py:536 
        with open(
            os.path.join(data_dir, self.dev_file if filename is None else filename), "r", encoding="utf-8"
        ) as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a4ba32f1511edfb — Filesystem access.
pkgs/python/[email protected]/src/transformers/data/processors/utils.py:119 
        with open(input_file, "r", encoding="utf-8-sig") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc413bd5b15ee3bf — Filesystem access.
pkgs/python/[email protected]/src/transformers/distributed/configuration_utils.py:62 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7aebb8776e0ec59 — Filesystem access.
pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:133 
    with open(module_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce3eee3b8b922f06 — Filesystem access.
pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:186 
    with open(filename, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6562dc746bfe6dde — Filesystem access.
pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:298 
        module_hash: str = hashlib.sha256(b"".join(bytes(f) + f.read_bytes() for f in module_files)).hexdigest()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6171c1c7efac0127 — Filesystem access.
pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:773 
        with open(requirements, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eaf2e09d620e106a — Filesystem access.
pkgs/python/[email protected]/src/transformers/feature_extraction_utils.py:611 
        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #636f585c879f9a1d — Filesystem access.
pkgs/python/[email protected]/src/transformers/feature_extraction_utils.py:639 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ce99035454e9db4 — Filesystem access.
pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:995 
        with open(json_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19b062662d89d349 — Filesystem access.
pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1156 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ceee25e6b2323881 — Filesystem access.
pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1276 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #530b22ebcccf88f1 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/generation/utils.py:2041 
            os.environ["TOKENIZERS_PARALLELISM"] = "0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b694576480ca26b — Filesystem access.
pkgs/python/[email protected]/src/transformers/hf_argparser.py:333 
                    file_args += args_file.read_text().split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46f74b0f6f889146 — Filesystem access.
pkgs/python/[email protected]/src/transformers/hf_argparser.py:403 
        with open(Path(json_file), encoding="utf-8") as open_json_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f18382df60de1800 — Filesystem access.
pkgs/python/[email protected]/src/transformers/hf_argparser.py:425 
        outputs = self.parse_dict(yaml.safe_load(Path(yaml_file).read_text()), allow_extra_keys=allow_extra_keys)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2076265cf75beb77 — Filesystem access.
pkgs/python/[email protected]/src/transformers/image_processing_base.py:417 
        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1902133b1702b833 — Filesystem access.
pkgs/python/[email protected]/src/transformers/image_processing_base.py:445 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f429ddde1f886faf — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/accelerate.py:114 
                local_rank = int(os.environ.get("LOCAL_RANK", 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62fa8dbc4c19143d — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/fsdp.py:51 
            and strtobool(os.environ.get("ACCELERATE_USE_FSDP", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d013c5be6051ee6 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/fsdp.py:52 
            and strtobool(os.environ.get("FSDP_CPU_RAM_EFFICIENT_LOADING", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #730226a1bff42998 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/hub_kernels.py:59 
    _TRANSFORMERS_USE_HUB_KERNELS = os.environ.get("USE_HUB_KERNELS", "YES").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b7fef0dcbab8d58 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:39 
if os.getenv("WANDB_MODE") == "offline":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b875b62e8ee7581b — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:175 
    if os.getenv("DISABLE_MLFLOW_INTEGRATION", "FALSE").upper() == "TRUE":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf0cc8788eafff84 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:211 
    if os.getenv("DISABLE_KUBEFLOW_INTEGRATION", "FALSE").upper() == "TRUE":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c179f7b4759ac17f — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:213 
    return os.getenv("KUBEFLOW_TRAINER_SERVER_URL") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc773a5f99f2c1c7 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:435 
    ray_scope = os.getenv("RAY_SCOPE", "last")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ceebd1198d103d98 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:601 
        self.logging_dir = os.getenv("TENSORBOARD_LOGGING_DIR", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e135e4c240f4b0a1 — Filesystem access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:663 
    with open(f"{output_dir}/model_architecture.txt", "w+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05fb4cf9591b1570 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:708 
        self._log_model = WandbLogModel(os.getenv("WANDB_LOG_MODEL", "false"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d88d374aac46d57 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:762 
                    project=os.getenv("WANDB_PROJECT", "huggingface"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f12c4bf0e7b2fed — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:774 
            _watch_model = os.getenv("WANDB_WATCH", "false")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e24fd155c670175b — Filesystem access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:814 
                                fa.write(f.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32a8c644a383efc8 — Filesystem access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:877 
                            fa.write(f.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ec7df987e915eb5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1102 
        log_assets = os.getenv("COMET_LOG_ASSETS", "FALSE").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b21af7ba715f84e — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1106 
            comet_old_mode = os.getenv("COMET_MODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #944125a332dc5ea5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1266 
        self._log_artifacts = os.getenv("HF_MLFLOW_LOG_ARTIFACTS", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d143bb4be5198bb4 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1267 
        self._nested_run = os.getenv("MLFLOW_NESTED_RUN", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8d1cceb487fa33e — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1268 
        self._tracking_uri = os.getenv("MLFLOW_TRACKING_URI", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4265b30d0b3e1e26 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1269 
        self._experiment_name = os.getenv("MLFLOW_EXPERIMENT_NAME", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca177275fc4fef75 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1270 
        self._flatten_params = os.getenv("MLFLOW_FLATTEN_PARAMS", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff44449627e41543 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1271 
        self._run_id = os.getenv("MLFLOW_RUN_ID", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ef6d07ebe7645f8 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1272 
        self._max_log_params = os.getenv("MLFLOW_MAX_LOG_PARAMS", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #812ca0df8a8b25e3 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1335 
            mlflow_tags = os.getenv("MLFLOW_TAGS", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad5e907e175d4c9b — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1419 
        self.log_artifacts = os.getenv("HF_DAGSHUB_LOG_ARTIFACTS", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #073c15df7d7513a6 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1420 
        self.name = os.getenv("HF_DAGSHUB_MODEL_NAME") or "main"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da2b3e24384a177a — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1421 
        self.remote = os.getenv("MLFLOW_TRACKING_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d594ddf639da20ec — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1425 
            branch=os.getenv("BRANCH") or "main",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f99120f29f88f25 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1840 
                    self._log_model = os.getenv(
                        "CLEARML_LOG_MODEL",
                        "FALSE" if not ClearMLCallback._task_created_in_callback else "TRUE",
                    ).upper() in ENV_VARS_TRUE_VALUES.union({"TRUE"})

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4663b64547199b5a — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1847 
                        project_name=os.getenv("CLEARML_PROJECT", "HuggingFace Transformers"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af2fca90cdc590c4 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1848 
                        task_name=os.getenv("CLEARML_TASK", "Trainer"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d14fd08773a8c098 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1852 
                    self._log_model = os.getenv("CLEARML_LOG_MODEL", "TRUE").upper() in ENV_VARS_TRUE_VALUES.union(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae0311400b35bcb0 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2121 
            log_model_env = os.getenv("HF_DVCLIVE_LOG_MODEL", "FALSE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e359afc1ca3eb2e7 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2203 
        self._log_model = os.getenv("SWANLAB_LOG_MODEL", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58533afd25624d5e — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2274 
            init_args["project"] = os.getenv("SWANLAB_PROJECT", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f50cff2def83d10 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2276 
            run_id = os.getenv("SWANLAB_RUN_ID", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cf96398b1371c3c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2280 
            resume = os.getenv("SWANLAB_RESUME", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4b5c7588ac4d869 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2426 
        ca_file = os.environ.get(self._ENV_CA_CERT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c68809c9e8cfd02 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2444 
        token_path = os.environ.get(self._ENV_TOKEN_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #543409a712e194d1 — Filesystem access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2450 
            with open(token_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bee6526c00810a5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2466 
            url = os.environ.get(self._ENV_SERVER_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b2ba0062509a0c5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/mxfp4.py:440 
        rank = int(os.environ.get("LOCAL_RANK", "0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #478d19a29af4a871 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/npu_flash_attention.py:30 
SPARSE_MODE = int(os.getenv("NPU_FA2_SPARSE_MODE", default=DOWN_RIGHT_ALIGNED_CAUSAL_MASK_MODE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80a3fafd66e2435f — Filesystem access.
pkgs/python/[email protected]/src/transformers/integrations/peft.py:1009 
        with open(_adapter_model_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a8d5859d3310063 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:62 
                rank = int(os.environ["RANK"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cb159249a06e9de — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:63 
                local_rank = int(os.environ["LOCAL_RANK"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3044e0454a172f8d — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:64 
                world_size = int(os.environ["WORLD_SIZE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a545f1cabff8b388 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:81 
            current_device.set_device(int(os.environ["LOCAL_RANK"]))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51a63a8598270f8f — Environment-variable access.
pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:100 
        device_map = torch.device(f"{device_mesh.device_type}:{int(os.environ['LOCAL_RANK'])}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08d0227fdf448ff2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/model_debugging_utils.py:243 
    with open(full_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25526f217e91ba92 — Filesystem access.
pkgs/python/[email protected]/src/transformers/model_debugging_utils.py:266 
    with open(summary_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0df6b43b387acd6d — Environment-variable access.
pkgs/python/[email protected]/src/transformers/modeling_flash_attention_utils.py:636 
            deterministic if deterministic is not None else os.getenv("FLASH_ATTENTION_DETERMINISTIC", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54ca4809947dc67d — Environment-variable access.
pkgs/python/[email protected]/src/transformers/modeling_utils.py:153 
XLA_USE_BF16 = os.environ.get("XLA_USE_BF16", "0").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8389dd335879558f — Environment-variable access.
pkgs/python/[email protected]/src/transformers/modeling_utils.py:154 
XLA_DOWNCAST_BF16 = os.environ.get("XLA_DOWNCAST_BF16", "0").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #752807112bd4c099 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/modeling_utils.py:191 
        and int(os.environ.get("LOCAL_RANK", "-1")) == 0

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #915ef8b4b8266828 — Filesystem access.
pkgs/python/[email protected]/src/transformers/modeling_utils.py:1957 
        with open(class_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d649f57e8e9baac9 — Filesystem access.
pkgs/python/[email protected]/src/transformers/modeling_utils.py:1976 
        with open(class_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #300161e28f716d97 — Filesystem access.
pkgs/python/[email protected]/src/transformers/modeling_utils.py:3430 
            with open(save_index_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a6e87b8eba25be5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/modeling_utils.py:3975 
        if device_map == "auto" and int(os.environ.get("WORLD_SIZE", "0")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c80b415f3d2cef1 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/auto/auto_factory.py:304 
                with open(maybe_adapter_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e19d206e156f9eb2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/auto/processing_auto.py:375 
                with open(tokenizer_config_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a906d3a33cee18e — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/auto/tokenization_auto.py:391 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4c4e583557e34c0 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/auto/tokenization_auto.py:398 
    with open(merges_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a82dfe5bd63ca09 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/auto/tokenization_auto.py:550 
    with open(resolved_config_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2850fe2fbd1c79f — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bark/processing_bark.py:101 
                with open(speaker_embeddings_path) as speaker_embeddings_json:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e879a45b3817625 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bark/processing_bark.py:164 
            with open(os.path.join(save_directory, speaker_embeddings_dict_path), "w") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f6ab7e1691e0600 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bartpho/tokenization_bartpho.py:133 
        with open(monolingual_vocab_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #259d884693c289bd — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bartpho/tokenization_bartpho.py:306 
            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef894f3879ae0521 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bartpho/tokenization_bartpho.py:315 
            with open(out_monolingual_vocab_file, "w", encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0c91a33122f1ccf — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bert/tokenization_bert.py:33 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ce048806cd77d5b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bert/tokenization_bert_legacy.py:32 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d43c40a334683e3 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bert/tokenization_bert_legacy.py:245 
        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e23da4b91c1870e9 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bert_japanese/tokenization_bert_japanese.py:41 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd56765b2173b40e — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bert_japanese/tokenization_bert_japanese.py:278 
            with open(vocab_file, "wb") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e86f42b87d9ec454 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bert_japanese/tokenization_bert_japanese.py:282 
            with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06bfbe630c15f3c2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:142 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fb47b60ebaf34ff — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:316 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bd80b08cfa5aaf5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:324 
        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee2a90a54141532b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:338 
                with open(f, "r", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1579c76a5469f1cc — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:116 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85ddbe3c920e417b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:119 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71cabe0401a930c3 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:293 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8808f9e2c0f0d062 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:297 
        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a14f254e41bded2b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:89 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a2230eed0ed0064 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:92 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dca4e34a60f7f6dc — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:203 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8cb3080dc13c95c — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:207 
        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2e1cf8508676589 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/clvp/tokenization_clvp.py:149 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2466a38173ecf879 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/clvp/tokenization_clvp.py:155 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72ed989f747961ce — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/cpm/tokenization_cpm.py:324 
            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c92efab8a4f18c48 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/cpmant/tokenization_cpmant.py:37 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46e0efa848edf644 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/cpmant/tokenization_cpmant.py:219 
        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97f3537722bb498d — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/ctrl/tokenization_ctrl.py:128 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5dede35e80282ac5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/ctrl/tokenization_ctrl.py:131 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f515cce3bcab694a — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/esm/openfold_utils/residue_constants.py:417 
    stereo_chemical_props = resources.read_text("openfold.resources", "stereo_chemical_props.txt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39e7cc47b4a914c9 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/esm/tokenization_esm.py:28 
    with open(vocab_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6982ff5e013a7066 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/esm/tokenization_esm.py:136 
        with open(vocab_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c32529a9f9828353 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fastspeech2_conformer/tokenization_fastspeech2_conformer.py:65 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d84415297886ea9 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fastspeech2_conformer/tokenization_fastspeech2_conformer.py:163 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c09f2c5509869265 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:237 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce0a6d444fb88610 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:240 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2afca725b4f3b2f — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:498 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ce9c78ba7b7808c — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:502 
        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9f7dc29ea54a929 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:204 
        with open(src_vocab_file, encoding="utf-8") as src_vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79a42428928c2f89 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:206 
        with open(tgt_vocab_file, encoding="utf-8") as tgt_vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7428523f32baa791 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:209 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4759e99138cdaafe — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:446 
        with open(src_vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a696d47af5dd401a — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:449 
        with open(tgt_vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da7a9a9c0a1b490b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:454 
        with open(merges_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44df3af1a3c92640 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:35 
    with open(emoji_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #926b427c191e87d4 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:41 
    with open(vocab_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44dcd81999c33f4e — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:180 
        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #550651ebeede3ef6 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:190 
        with open(emoji_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29651cb4411c569e — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/luke/tokenization_luke.py:287 
            with open(entity_vocab_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd433277d4cc1c46 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/m2m_100/tokenization_m2m_100.py:311 
            with open(spm_save_path, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33dce2c4d1ddee6d — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/m2m_100/tokenization_m2m_100.py:375 
    with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e06f41226e3ad725 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/m2m_100/tokenization_m2m_100.py:380 
    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #daf8f5a12ab47019 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/marian/tokenization_marian.py:352 
                with open(spm_save_path, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5700220e306f79be — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/marian/tokenization_marian.py:416 
    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da3e357b41c56ef5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/marian/tokenization_marian.py:421 
    with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #128a2cd1fe81f634 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/megatron_gpt2/checkpoint_reshaping_and_interoperability.py:598 
        with open(save_index_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd492a4a0c2a8158 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/megatron_gpt2/checkpoint_reshaping_and_interoperability.py:651 
    with open(tracker_filepath, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70ac0a0baa7456d0 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/mgp_str/tokenization_mgp_str.py:53 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf2b3f6c6e6dd687 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/mgp_str/tokenization_mgp_str.py:97 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #123c9e1d27fa0090 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/mluke/tokenization_mluke.py:308 
            with open(entity_vocab_file, encoding="utf-8") as entity_vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4362c19fbadded8 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/mluke/tokenization_mluke.py:1713 
        with open(entity_vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #846aee6def015ac2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/myt5/tokenization_myt5.py:46 
            with open(rewriting_rules, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbaf780acc6e57a3 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/myt5/tokenization_myt5.py:195 
        self.byte_maps = json.load(open(vocab_file, "r"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a04f21fb0418134 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/myt5/tokenization_myt5.py:373 
        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c98db3835a94aa9 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/oneformer/image_processing_oneformer.py:109 
    with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8304918ed43ef793 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/oneformer/image_processing_pil_oneformer.py:240 
    with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #197e393ea4513e4c — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/phobert/tokenization_phobert.py:126 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f235a70005ce2e5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/phobert/tokenization_phobert.py:310 
            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01020ccc679c90d2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/phobert/tokenization_phobert.py:331 
                with open(f, "r", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd0de4cc5640d149 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/pop2piano/tokenization_pop2piano.py:111 
        with open(vocab, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0ac9f43131f52cf — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/pop2piano/tokenization_pop2piano.py:358 
        with open(out_vocab_file, "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3feed0ab4579cc6b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/prophetnet/tokenization_prophetnet.py:259 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44c8005588b991f5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/prophetnet/tokenization_prophetnet.py:438 
        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7013cb422467f93 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:134 
        if not strtobool(os.environ.get("TRUST_REMOTE_CODE", "False")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9309bf866062add6 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:141 
        with open(passages_path, "rb") as passages_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94ce828624764f8c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:150 
        if not strtobool(os.environ.get("TRUST_REMOTE_CODE", "False")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #184b46e74b2558e2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:157 
        with open(resolved_meta_path, "rb") as metadata_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05223a7268a0ae39 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:52 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e3b567d1934961a — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:139 
        with open(word_shape_file, "r", encoding="utf8") as in_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a22047fdfdafac6c — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:142 
        with open(word_pronunciation_file, "r", encoding="utf8") as in_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36dc12ecb4c7bdad — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:1077 
        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b645a65ecb0fb1c — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:1088 
        with open(word_shape_file, "w", encoding="utf8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #062766923869352b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:1091 
        with open(word_pronunciation_file, "w", encoding="utf8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c56297d13a689e83 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/siglip/tokenization_siglip.py:345 
            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2e6ca02b68b1b50 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/speech_to_text/tokenization_speech_to_text.py:271 
            with open(spm_save_path, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43012202a873d287 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/speech_to_text/tokenization_speech_to_text.py:285 
    with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b2560a7bb291bee — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/speech_to_text/tokenization_speech_to_text.py:290 
    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d9641669218cd02 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/splinter/tokenization_splinter.py:33 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ab8c9714186a591 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/tapas/tokenization_tapas.py:91 
    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aae4ea69ccf999f2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/tapas/tokenization_tapas.py:394 
        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c488d24bc48a6656 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/vits/tokenization_vits.py:83 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4930337e9186e39f — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/vits/tokenization_vits.py:242 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af3377b115b3470f — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/wav2vec2/tokenization_wav2vec2.py:154 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75160a0b3c2d5394 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/wav2vec2/tokenization_wav2vec2.py:647 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ecb00cb9288c6018 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/wav2vec2_phoneme/tokenization_wav2vec2_phoneme.py:129 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13e57b4ce4d12ad6 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/wav2vec2_phoneme/tokenization_wav2vec2_phoneme.py:565 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d76d9249dadef74 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:266 
            with open(normalizer_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ca58d8c722bf72c — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:560 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f737db8a66401d0c — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:563 
        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #769352f13aa5fc4b — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:568 
            with open(normalizer_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f253d9b473d3918f — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:244 
        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80debc1c3b1671a4 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:247 
        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #392adcd4afac9644 — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:541 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b563600634c328a — Filesystem access.
pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:545 
        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c84ce577aa76efba — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/__init__.py:694 
                with open(maybe_adapter_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76392e3e002cae60 — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/audio_classification.py:174 
                with open(inputs, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c93cb8866c4b4aa — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/automatic_speech_recognition.py:348 
                with open(inputs, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6ba734aff3e4e3f — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:454 
        with open(binary_path, "wb+") as f_output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d67d4e63fe2dfab — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:517 
        with open(self.input_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ac55ede39a6c875 — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:532 
        with open(self.output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #413f2f8e34def6ef — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:560 
        with open(input_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd93690b75d58869 — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:577 
        with open(self.output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6045caa0f429458 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:1181 
        if "TOKENIZERS_PARALLELISM" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03c7ed73c60cf137 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:1183 
            os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf9ee38271e4877c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:1301 
        if "TOKENIZERS_PARALLELISM" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20d464eff3471590 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/pipelines/base.py:1303 
            os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1dc6991637277b0f — Filesystem access.
pkgs/python/[email protected]/src/transformers/pipelines/zero_shot_audio_classification.py:111 
                with open(audio, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36c55903a3148188 — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:791 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be0657b9e94ae663 — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:871 
            with open(output_chat_template_file_jinja, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9eacf54bb52615be — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:879 
                    with open(output_chat_template_file_jinja, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8798aa2c48109b04 — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:885 
                    with open(template_filepath, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fd9ba5160a18ea5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:1073 
            with open(resolved_chat_template_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ad2348e6ecbafdc — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:1085 
                template_name: open(template_file, "r", encoding="utf-8").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c19eda71d13c94f2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:1089 
                with open(resolved_raw_chat_template_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ab7697a4e8584ac — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:1104 
                with open(resolved_processor_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d4d559be4a704a5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/processing_utils.py:1130 
                reader = open(resolved_audio_tokenizer_file, "r", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3469dfdd6fff425 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:252 
        value = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99b83056c3191d58 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:268 
        value = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bd3f20450716755 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:983 
    if "TRANSFORMERS_TEST_BACKEND" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9248dfcde374f22 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:984 
        backend = os.environ["TRANSFORMERS_TEST_BACKEND"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4eb33db026f3e695 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:993 
    if "TRANSFORMERS_TEST_DEVICE" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e4445553352b8f5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:994 
        torch_device = os.environ["TRANSFORMERS_TEST_DEVICE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b2410a9d14a3475 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2043 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e3fa655952761bd — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2165 
            for k in list(os.environ.keys()):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee9f588c960cf18a — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2167 
                    del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c66229df79494c8 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2178 
    return mock.patch.dict(os.environ, kwargs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c2fd0f85636ffee — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2193 
    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78f3747a31703803 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2295 
        with open(report_files["durations"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d18574830b6760c1 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2325 
    with open(report_files["failures_long"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6259560cff0d4cb — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2330 
    with open(report_files["failures_short"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #240b73f3b51f8303 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2335 
    with open(report_files["failures_line"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7b1d9c8bcfcfeb0 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2339 
    with open(report_files["errors"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27295362a8f94b19 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2343 
    with open(report_files["warnings"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d99125d609cf8d5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2357 
    with open(report_files["summary_short"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e576d0d428884e2a — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2361 
    with open(report_files["stats"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f512751b6c7e0180 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2461 
    worker = os.environ.get("PYTEST_XDIST_WORKER", "gw0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4618356a893399d9 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2508 
    with open(file_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdd0168ab4d79055 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2729 
        timeout = int(os.environ.get("PYTEST_TIMEOUT", "600"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68d10bdcf0f2d84e — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2765 
        if os.getenv("_INSIDE_SUB_PROCESS", None) == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c17d947482688fb7 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2768 
            test = " ".join(os.environ.get("PYTEST_CURRENT_TEST").split(" ")[:-1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fe143979844bbf02 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2770 
                env = copy.deepcopy(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #252530fc5b208f29 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:2887 
    skip_cuda_tests: bool = os.environ.get("SKIP_CUDA_DOCTEST", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4356c8c4e3b4f01 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3125 
    if "TRANSFORMERS_TEST_DEVICE_SPEC" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e9d200efc5cf7f0 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3126 
        device_spec_path = os.environ["TRANSFORMERS_TEST_DEVICE_SPEC"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #713fe7d1beb5374c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3149 
        if "TRANSFORMERS_TEST_DEVICE" in os.environ and torch_device != device_name:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f88d559925fb62dd — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3348 
    force_fullgraph = os.environ.get("TORCH_COMPILE_FORCE_FULLGRAPH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #923c05fd43449d40 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3371 
    full_test_name = os.environ.get("PYTEST_CURRENT_TEST", "").split(" ")[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b220135f49ad0000 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3451 
    with open(actual_test_file) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f16682424ced49bf — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3457 
    with open(caller_path) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #342d414d23dd0d33 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3545 
    p = os.path.join(os.environ.get("_PATCHED_TESTING_METHODS_OUTPUT_DIR", ""), "captured_info.txt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #436bab46998f02a9 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3547 
    with open(p, "a") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a9c5773823a84b4 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3664 
        if not os.environ.get("PYTEST_CURRENT_TEST", ""):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e654cb85dfc0995c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3701 
            if os.getenv("CI") == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e803de40dc31efd — Environment-variable access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:3777 
    p = os.path.join(os.environ.get("_PATCHED_TESTING_METHODS_OUTPUT_DIR", ""), "captured_info.txt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f1213124821b256 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:4131 
    with open(file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba10fc80f0751a66 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:4136 
    with open(file, "r") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3975ed69bc2c25dc — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:4372 
            with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f424e27fc947612 — Filesystem access.
pkgs/python/[email protected]/src/transformers/testing_utils.py:4381 
            with open(new_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84c2f0bae4dadc3c — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_python.py:1390 
        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #475038cfa5c8dbd5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_python.py:1399 
        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a098c6c03c69166 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1643 
                    with open(resolved_config_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73c7d4af7cc3c367 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1762 
            with open(tokenizer_config_file, encoding="utf-8") as tokenizer_config_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #816494d670881fb7 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1781 
            with open(chat_template_file, encoding="utf-8") as chat_template_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a070bb2c3587a88 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1788 
            with open(template_file) as chat_template_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4921b331aa1c8d40 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1850 
                with open(special_tokens_map_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7072600c2a53e27 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1880 
                with open(added_tokens_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2629825925dc278 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1893 
                with open(tokenizer_file, encoding="utf-8") as tokenizer_file_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2089e9ecfaeb01b1 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:2096 
        with open(tokenizer_config_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #019000e997b6b1e8 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:2149 
            with open(added_tokens_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1576fc9fb3de33ed — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3264 
            with open(chat_template_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c7458aef4c5922a — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3275 
                    with open(chat_template_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff3fbcb5d1ed24cb — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3282 
                    with open(template_filepath, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #969ce5c0d1c78909 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3460 
            with open(resolved_vocab_file, "r", encoding="utf-8") as vf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56585a3797b36122 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3486 
                with open(resolved_vocab_txt, "r", encoding="utf-8") as vf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f28086ac062bf23e — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3512 
            with open(resolved_merges_file, "r", encoding="utf-8") as mf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b1eb989512f2b02 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_sentencepiece.py:260 
            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb911bd8ebf1454e — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_tokenizers.py:121 
            with open(fast_tokenizer_file, encoding="utf-8") as tokenizer_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1223d0aec262d16 — Filesystem access.
pkgs/python/[email protected]/src/transformers/tokenization_utils_tokenizers.py:1313 
                with open(_config_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #871fe11f3d8f9dd1 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/trainer.py:2432 
                model, device_ids=[int(os.getenv("SMDATAPARALLEL_LOCAL_RANK"))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #087a8d02f6f38b96 — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer.py:3987 
        with open(model_card_filepath, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58cc1fd8a0d086ea — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer.py:4092 
                with open(index_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #959f853a32a28685 — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer_callback.py:146 
        with open(json_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd049b67efe00a7b — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer_callback.py:152 
        with open(json_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d98ec40dc65444d2 — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer_jit_checkpoint.py:60 
            with open(sentinel_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93b8be8d8cd35766 — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer_pt_utils.py:943 
    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ed7af92eefcb1aa — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer_pt_utils.py:949 
            with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18b64ae366e76d5c — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer_pt_utils.py:955 
        with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bdb4f30827e3d02 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/trainer_utils.py:166 
        os.environ["CUDA_LAUNCH_BLOCKING"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e50fdb506035286d — Environment-variable access.
pkgs/python/[email protected]/src/transformers/trainer_utils.py:167 
        os.environ["CUBLAS_WORKSPACE_CONFIG"] = ":16:8"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f48432b47842cb7 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/trainer_utils.py:169 
        os.environ["ASCEND_LAUNCH_BLOCKING"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #682fc873d0229d64 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/trainer_utils.py:170 
        os.environ["HCCL_DETERMINISTIC"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ca5a4cb8c4e2e55 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/trainer_utils.py:172 
        os.environ["FLASH_ATTENTION_DETERMINISTIC"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #913bb7047ee2f5c5 — Filesystem access.
pkgs/python/[email protected]/src/transformers/trainer_utils.py:1092 
    with open(load_index, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fac1b3e5f2e2caed — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:85 
    if os.environ.get("TORCHELASTIC_RUN_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b3b3a5449b3d740 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1541 
        self.mixed_precision = os.environ.get("ACCELERATE_MIXED_PRECISION", "no")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78e7f8590671486c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1559 
                os.environ["ACCELERATE_DYNAMO_BACKEND"] = self.torch_compile_backend

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de7c4f1c2ae3cfd6 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1561 
                    os.environ["ACCELERATE_DYNAMO_MODE"] = self.torch_compile_mode

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e01e08a09a2a39c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1633 
        elif strtobool(os.environ.get("ACCELERATE_USE_DEEPSPEED", "false")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1cc1111aa4ceb70 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1793 
        if self.use_cpu or strtobool(os.environ.get("ACCELERATE_USE_CPU", "False")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e398196f648ac966 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1817 
                os.environ["ACCELERATE_USE_DEEPSPEED"] = "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #795451b3eceeb8d6 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1820 
                del os.environ["ACCELERATE_USE_DEEPSPEED"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb25cd3f1854464b — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:1860 
                    "cuda:0" if torch.cuda.is_available() else os.environ.get("ACCELERATE_TORCH_DEVICE", "cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f2fd79fb67195ba — Filesystem access.
pkgs/python/[email protected]/src/transformers/training_args.py:2701 
            with open(self.fsdp_config, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94814c0b201764df — Environment-variable access.
pkgs/python/[email protected]/src/transformers/training_args.py:2801 
            os.environ["FSDP_CPU_RAM_EFFICIENT_LOADING"] = cpu_ram_efficient_loading

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9d1905f935b1d539 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/transformers/utils/attention_visualizer.py:183 
            img = Image.open(io.BytesIO(httpx.get(img, follow_redirects=True).content))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #fba9d7b90bdfba4a — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/generic.py:347 
        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93d1b36f016a6521 — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/generic.py:827 
        with open(pretrained_model_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c959c8b8d263ba1 — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/generic.py:833 
        with open(os.path.join(pretrained_model_path, "config.json")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19fbea47550a6a6a — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:92 
HF_MODULES_CACHE = os.getenv("HF_MODULES_CACHE", os.path.join(constants.HF_HOME, "modules"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff3ff40fa6e4d8ca — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:163 
        instance_data = httpx.get(os.environ["ECS_CONTAINER_METADATA_URI"]).json()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2776329b47aecc0f — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:170 
    sagemaker_params = json.loads(os.getenv("SM_FRAMEWORK_PARAMS", "{}"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9d40bb8ce6e28bb — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:172 
    training_job_arn = os.getenv("TRAINING_JOB_ARN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3902886366c58385 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:176 
        "sm_framework": os.getenv("SM_FRAMEWORK_MODULE", None),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52ff11197d6a58a1 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:177 
        "sm_region": os.getenv("AWS_REGION", None),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d3a3b7726677cdd — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:178 
        "sm_number_gpu": os.getenv("SM_NUM_GPUS", "0"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04b0cfc4f5d8935c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:179 
        "sm_number_cpu": os.getenv("SM_NUM_CPUS", "0"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a211854101ad0aa7 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:200 
    if os.environ.get("TRANSFORMERS_IS_CI", "").upper() in ENV_VARS_TRUE_VALUES:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #812f6e216f217c9e — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/hub.py:864 
    with open(index_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87b92a3b15fbd1e7 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:115 
    return os.getenv(env_variable, "false").lower() in ("true", "1", "y", "yes", "on")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f467cb73323a754c — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:120 
    return os.getenv(env_variable, "true").lower() in ("false", "0", "n", "no", "off")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c9965b98693883e — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:127 
USE_TORCH_XLA = os.environ.get("USE_TORCH_XLA", "1").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54e47650db47f213 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:328 
    pytorch_cndev_based_mlu_check_previous_value = os.environ.get("PYTORCH_CNDEV_BASED_MLU_CHECK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e57d279b9ef2a156 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:330 
        os.environ["PYTORCH_CNDEV_BASED_MLU_CHECK"] = str(1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88d4d1538de07729 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:334 
            os.environ["PYTORCH_CNDEV_BASED_MLU_CHECK"] = pytorch_cndev_based_mlu_check_previous_value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a5a28c6fec2a3d8 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:336 
            os.environ.pop("PYTORCH_CNDEV_BASED_MLU_CHECK", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0003de5900e3a803 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:406 
    if os.environ.get("PT_HPU_LAZY_MODE", "1") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6028ff7419aea1ad — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1520 
    if os.getenv("TRANSFORMERS_DISABLE_TORCH_CHECK", "0") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41a7ed20a186f3e7 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1554 
        if "DATABRICKS_RUNTIME_VERSION" in os.environ and os.environ["DATABRICKS_RUNTIME_VERSION"] < "11.0":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98c1d2d2d155009d — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1566 
    sagemaker_params = os.getenv("SM_FRAMEWORK_PARAMS", "{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eed87cf7656fc775 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1580 
    smp_options = os.getenv("SM_HP_MP_PARAMETERS", "{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #446e8de5cd42bc98 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1590 
    mpi_options = os.getenv("SM_FRAMEWORK_PARAMS", "{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa8612e1921ed587 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1603 
    return "SAGEMAKER_JOB_NAME" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d81d65b9c0eab4d — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/import_utils.py:2713 
        with open(os.path.join(module_path, module_name), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66b30f5dce07744f — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/logging.py:64 
    env_level_str = os.getenv("TRANSFORMERS_VERBOSITY", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91724c0e3393bac4 — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/logging.py:94 
            sys.stderr = open(os.devnull, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13f99c58d1783cf5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/logging.py:103 
        if os.getenv("TRANSFORMERS_VERBOSITY", None) == "detail":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7226955f85832c5 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/logging.py:107 
        ci = os.getenv("CI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bed26f6e0762a6e — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/logging.py:315 
    no_advisory_warnings = os.getenv("TRANSFORMERS_NO_ADVISORY_WARNINGS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a864599be7f00b5e — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/network_logging.py:172 
        Path(dump_path).write_text(json.dumps(records), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccbfc480dbfc3bbd — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/network_logging.py:182 
                records = json.loads(Path(record_file).read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #243882d3e1ad732b — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/network_logging.py:327 
        report_path.write_text(json.dumps(self.build_report(), indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f9b7a8714ce8748 — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/network_logging.py:338 
    enabled_raw = os.environ.get("NETWORK_DEBUG_REPORT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cb4a22740c3234f — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/network_logging.py:344 
    output_path = os.environ.get("NETWORK_DEBUG_REPORT_PATH", "").strip() or _DEFAULT_REPORT_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2311499fa3fce79b — Environment-variable access.
pkgs/python/[email protected]/src/transformers/utils/notebook.py:128 
        if "VSCODE_PID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18e5e90f95d7eeb8 — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/pytest_helpers.py:39 
    data = json.loads(p.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54b33b9a841aa948 — Filesystem access.
pkgs/python/[email protected]/src/transformers/utils/quantization_config.py:142 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07a3e228b80a375c — Filesystem access.
pkgs/python/[email protected]/src/transformers/video_processing_utils.py:769 
        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dccec37e76aa29b — Filesystem access.
pkgs/python/[email protected]/src/transformers/video_processing_utils.py:789 
        with open(json_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-cloud-storage

python dependency
high pii_flow dependency Excluded from app score #3d4c21e5eaf006f5 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/google/cloud/storage/asyncio/retry/writes_resumption_strategy.py:97 · flow /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/google/cloud/storage/asyncio/retry/writes_resumption_strategy.py:74 → /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/google/cloud/storage/asyncio/retry/writes_resumption_strategy.py:97 
            requests.append(request)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
medium telemetry dependency Excluded from app score #0dfe969c8641f345 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/google/cloud/storage/_opentelemetry_tracing.py:45 
    from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #ca8163189bd1e598 — Environment-variable access.
pkgs/python/[email protected]/google/cloud/_storage_v2/services/storage/client.py:205 
            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54a40a04e802aa56 — Environment-variable access.
pkgs/python/[email protected]/google/cloud/_storage_v2/services/storage/client.py:422 
        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #012b1fb902e11e07 — Environment-variable access.
pkgs/python/[email protected]/google/cloud/_storage_v2/services/storage/client.py:463 
        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c181a72c00a13763 — Environment-variable access.
pkgs/python/[email protected]/google/cloud/_storage_v2/services/storage/client.py:464 
        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41e3c0a6cd8233d5 — Environment-variable access.
pkgs/python/[email protected]/google/cloud/storage/_helpers.py:55 
_API_VERSION = os.getenv(_API_VERSION_OVERRIDE_ENV_VAR, "v1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b1595eda81cd81c — Environment-variable access.
pkgs/python/[email protected]/google/cloud/storage/_helpers.py:84 
    return os.environ.get(STORAGE_EMULATOR_ENV_VAR, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6831a2c666d53c1 — Environment-variable access.
pkgs/python/[email protected]/google/cloud/storage/_helpers.py:88 
    return os.getenv(
        _API_ENDPOINT_OVERRIDE_ENV_VAR, _DEFAULT_SCHEME + _TRUE_DEFAULT_STORAGE_HOST
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9642c001492122f — Environment-variable access.
pkgs/python/[email protected]/google/cloud/storage/_helpers.py:115 
    return os.getenv(
        environment_vars.PROJECT,
        os.getenv(environment_vars.LEGACY_PROJECT),
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7aa45992b546e1a — Environment-variable access.
pkgs/python/[email protected]/google/cloud/storage/_helpers.py:117 
        os.getenv(environment_vars.LEGACY_PROJECT),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64a0fcbac7f74133 — Filesystem access.
pkgs/python/[email protected]/google/cloud/storage/_media/_upload.py:1367 
        with open(self._filename, "br") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7641d563ac19664d — Environment-variable access.
pkgs/python/[email protected]/google/cloud/storage/_opentelemetry_tracing.py:33 
    val = os.environ.get(name, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b129d12bd6a3123 — Filesystem access.
pkgs/python/[email protected]/google/cloud/storage/blob.py:1275 
            with open(filename, "wb") as file_obj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03f76ce8582105c2 — Filesystem access.
pkgs/python/[email protected]/google/cloud/storage/blob.py:3046 
        with open(filename, "rb") as file_obj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f4e6676f78de1d4 — Environment-variable access.
pkgs/python/[email protected]/google/cloud/storage/client.py:226 
                    os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE") == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5c99b64c435b3fa — Filesystem access.
pkgs/python/[email protected]/google/cloud/storage/transfer_manager.py:902 
    with open(filename, "wb") as _:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #851e363cd00ae3e8 — Filesystem access.
pkgs/python/[email protected]/google/cloud/storage/transfer_manager.py:1243 
        self.f = open(filename, "rb+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0f2519a8e813d14 — Filesystem access.
pkgs/python/[email protected]/setup.py:94 
with open(os.path.join(package_root, "google/cloud/storage/version.py")) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f053e109d032e2c2 — Filesystem access.
pkgs/python/[email protected]/setup.py:99 
with io.open(readme_filename, encoding="utf-8") as readme_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

python dependency
high pii_flow dependency Excluded from app score #5777f5785271c3fa — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:255 · flow /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/openai/lib/azure.py:218 → /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/openai/lib/azure.py:255 
        self._azure_endpoint = httpx.URL(azure_endpoint) if azure_endpoint else None

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow dependency Excluded from app score #7ba1a0dbef945c69 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:536 · flow /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/openai/lib/azure.py:499 → /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/openai/lib/azure.py:536 
        self._azure_endpoint = httpx.URL(azure_endpoint) if azure_endpoint else None

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 58 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #b8940ffedefd7ea4 — Filesystem access.
pkgs/python/[email protected]/examples/image_stream.py:30 
            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #98acc8fe729780a2 — Filesystem access.
pkgs/python/[email protected]/examples/image_stream.py:41 
            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a5c55825467efc53 — Environment-variable access.
pkgs/python/[email protected]/examples/realtime/azure_realtime.py:31 
    endpoint = os.environ["AZURE_OPENAI_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e988b623b25ddfc2 — Environment-variable access.
pkgs/python/[email protected]/examples/realtime/azure_realtime.py:37 
    deployment_name = os.environ["AZURE_OPENAI_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d10ea93665f286f0 — Filesystem access.
pkgs/python/[email protected]/examples/uploads.py:30 
    data = file.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac24eb8d003d50a4 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:144 
api_type: _ApiType | None = _t.cast(_ApiType, _os.environ.get("OPENAI_API_TYPE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5dc91983002af18 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:146 
api_version: str | None = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a5753300feefbcf — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:148 
azure_endpoint: str | None = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bec3cab170a9f2c — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:150 
azure_ad_token: str | None = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37e2ab01f8414b52 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:283 
    return _os.environ.get("OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #922d10f4d5ba7cbd — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:287 
    return azure_endpoint is not None or _os.environ.get("AZURE_OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86fb8782ef498b86 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:292 
        _os.environ.get("AZURE_OPENAI_AD_TOKEN") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e720612a1a6e0d8d — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:308 
            azure_endpoint = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2ff6c9f711c3cb7 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:311 
            azure_ad_token = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3bae8a717e2f0a7 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:314 
            api_version = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f241c4a981acf96a — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:324 
            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #981414f726c91928 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:324 
            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(
                "AZURE_OPENAI_API_KEY"
            ) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0832533a3867bfe9 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:137 
            api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93364b7b86c757fb — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:150 
            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8beed6fd38ce17ce — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:154 
            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06490df33401750e — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:158 
            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02dfd6b2a3efeaf9 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:164 
            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #863c810dfe0db9d7 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:512 
            api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfa462d6a41b0fb7 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:525 
            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7902eebc72ab241 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:529 
            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d86ff9632ac23f2f — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:533 
            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a9324556fcd31d0 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:539 
            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #917cc6356c2c9198 — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:67 
            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fd8e0e180b2bca4 — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:79 
        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10b17120cf9ba296 — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:109 
            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #873a853faf40c77d — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:121 
        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #409b8666eab82b9b — Filesystem access.
pkgs/python/[email protected]/src/openai/_legacy_response.py:441 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #698f717aede638ad — Filesystem access.
pkgs/python/[email protected]/src/openai/_legacy_response.py:454 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #724d237222e59a26 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_models.py:119 
            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dc4719b7ea31848 — Filesystem access.
pkgs/python/[email protected]/src/openai/_response.py:513 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #443f20abee791ece — Filesystem access.
pkgs/python/[email protected]/src/openai/_response.py:555 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ed956fe8938291f — Environment-variable access.
pkgs/python/[email protected]/src/openai/_utils/_logs.py:23 
    env = os.environ.get("OPENAI_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74b83073a05bd133 — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_transform.py:248 
            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db3fb75bfc640fa7 — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_transform.py:414 
            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31e0a94e28f2611f — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_utils.py:371 
    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f7934c20af41b81 — Filesystem access.
pkgs/python/[email protected]/src/openai/cli/_api/audio.py:67 
        with open(args.file, "rb") as file_reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf5695bdc5a54918 — Filesystem access.
pkgs/python/[email protected]/src/openai/cli/_api/audio.py:90 
        with open(args.file, "rb") as file_reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0d85f09783337f5 — Filesystem access.
pkgs/python/[email protected]/src/openai/cli/_api/files.py:55 
        with open(args.file, "rb") as file_reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d487b5d9d72f9b26 — Filesystem access.
pkgs/python/[email protected]/src/openai/cli/_api/image.py:103 
        with open(args.image, "rb") as file_reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13101dd6a81d5989 — Filesystem access.
pkgs/python/[email protected]/src/openai/cli/_api/image.py:119 
        with open(args.image, "rb") as file_reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41e0511c44a1cf37 — Filesystem access.
pkgs/python/[email protected]/src/openai/cli/_api/image.py:125 
            with open(args.mask, "rb") as file_reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1d534ab14a872b0 — Environment-variable access.
pkgs/python/[email protected]/src/openai/cli/_tools/migrate.py:68 
    xdg = os.environ.get("XDG_CACHE_HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6293b0b50f9053ec — Environment-variable access.
pkgs/python/[email protected]/src/openai/cli/_tools/migrate.py:76 
    if not os.environ.get("DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c24b348aa6be0a0 — Filesystem access.
pkgs/python/[email protected]/src/openai/cli/_tools/migrate.py:121 
        with open(temp_file, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2960f81232aa4bb — Filesystem access.
pkgs/python/[email protected]/src/openai/lib/_validators.py:485 
                with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eaaa9b56598aa5bc — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:193 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60017b64945cb29f — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:196 
            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c934fc32dea27559 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:204 
            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a8d88d0f39ac928 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:218 
                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab34c580f77939e1 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:474 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f69a9b15b49df0f — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:477 
            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b4f7c9d745597b0 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:485 
            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8bf58b54a4821fc — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:499 
                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mcp

python dependency
high pii_flow dependency Excluded from app score #7cfc4ebb0972b859 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:452 · flow /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:433 → /tmp/closeopen-k8eta71w/pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:452 
        return httpx.Request("POST", token_url, data=refresh_data, headers=headers)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 31 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #0520bb93d3c94ef6 — Environment-variable access.
pkgs/python/[email protected]/.github/actions/conformance/client.py:72 
    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #66a5051e09c7d51d — Environment-variable access.
pkgs/python/[email protected]/.github/actions/conformance/client.py:281 
    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8debc36a9759d792 — Environment-variable access.
pkgs/python/[email protected]/.github/actions/conformance/client.py:349 
    scenario = os.environ.get("MCP_CONFORMANCE_SCENARIO")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7b0233227e8f1901 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/conformance-auth-client/mcp_conformance_auth_client/__init__.py:50 
    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7631c0f20f4c8868 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:343 
    server_url = os.getenv("MCP_SERVER_PORT", 8000)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8d3c6ba439617ae1 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:344 
    transport_type = os.getenv("MCP_TRANSPORT_TYPE", "streamable-http")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5c4d92536dd6fd37 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:345 
    client_metadata_url = os.getenv("MCP_CLIENT_METADATA_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5c39d410ac0578ff — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:24 
        self.api_key = os.getenv("LLM_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f53b7dab1e056c8a — Filesystem access.
pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:45 
        with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #dfcff7e1d3edc19e — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:83 
            env={**os.environ, **self.config["env"]} if self.config.get("env") else None,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #221ac33f777a2da1 — Filesystem access.
pkgs/python/[email protected]/examples/fastmcp/icons_demo.py:14 
icon_data = base64.standard_b64encode(icon_path.read_bytes()).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #37f9d1c8b1b2622b — Environment-variable access.
pkgs/python/[email protected]/examples/fastmcp/memory.py:52 
PROFILE_DIR = (Path.home() / ".fastmcp" / os.environ.get("USER", "anon") / "memory").resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9bdce6f317691c36 — Environment-variable access.
pkgs/python/[email protected]/examples/snippets/clients/completion_client.py:17 
    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e1cd17e3543c9b44 — Environment-variable access.
pkgs/python/[email protected]/examples/snippets/clients/display_utilities.py:17 
    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e80355b422f1a389 — Environment-variable access.
pkgs/python/[email protected]/examples/snippets/clients/stdio_client.py:19 
    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #113d3e21428389f2 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/binary_resources.py:9 
    with open("logo.png", "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #48d4ccc06373ceb1 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/embedded_resource_results.py:10 
    with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #448efc8b5b43de17 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/embedded_resource_results_binary.py:12 
    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7a8848a0d79b934a — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/prompt_embedded_resources.py:11 
    file_content = open(filename).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a2f09bb4fa012181 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/tool_errors.py:27 
    with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #32fe8a4bee486f8e — Filesystem access.
pkgs/python/[email protected]/scripts/update_doc_snippets.py:53 
        code = file.read_text().rstrip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a1aa7b1f4aa76b2e — Filesystem access.
pkgs/python/[email protected]/scripts/update_doc_snippets.py:109 
    content = doc_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #007a31964a06455b — Filesystem access.
pkgs/python/[email protected]/scripts/update_doc_snippets.py:134 
            doc_path.write_text(updated_content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57ddf180adb615b6 — Environment-variable access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:24 
        path = Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config"), "Claude")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b878ebabf244a5c — Filesystem access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:77 
            config_file.write_text("{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb59e07f864252e1 — Filesystem access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:88 
        config = json.loads(config_file.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0842ef6d80df753 — Filesystem access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:135 
        config_file.write_text(json.dumps(config, indent=2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #531121e069d21971 — Environment-variable access.
pkgs/python/[email protected]/src/mcp/cli/cli.py:282 
            env=dict(os.environ.items()),  # Convert to list of tuples for env update

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b65a4ff18aa866a2 — Environment-variable access.
pkgs/python/[email protected]/src/mcp/client/stdio/__init__.py:59 
        value = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #127bab03d14785d4 — Filesystem access.
pkgs/python/[email protected]/src/mcp/server/fastmcp/utilities/types.py:47 
            with open(self.path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #788ad817babcb53f — Filesystem access.
pkgs/python/[email protected]/src/mcp/server/fastmcp/utilities/types.py:94 
            with open(self.path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

chromadb

python dependency
medium telemetry dependency Excluded from app score #ee50b84a15c14bf6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/execution/executor/distributed.py:22 
from opentelemetry.trace import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e1786100acca2f98 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/proto/utils.py:4 
from opentelemetry.trace import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #79cb28ba84e6f357 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/server/fastapi/__init__.py:77 
from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #babf0d6a398a21ad — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:7 
from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ccb782a19ca5d16f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:8 
from opentelemetry.sdk.resources import SERVICE_NAME, Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #753f3b45b1901578 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:9 
from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a267e7c0734ec764 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:10 
from opentelemetry.sdk.trace.export import (
    BatchSpanProcessor,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5b60c9a2911c2823 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:13 
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #41ec09860f1c5173 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/fastapi.py:3 
from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #795e681d664f63b0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/grpc.py:5 
from opentelemetry.trace import StatusCode, SpanKind

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 54 low-confidence finding(s)
low env_fs dependency Excluded from app score #32421c8b5f7c1454 — Environment-variable access.
pkgs/python/[email protected]/chromadb/__init__.py:407 
            arg.value = arg.value or os.environ.get(arg.env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a3913a1163b1961 — Environment-variable access.
pkgs/python/[email protected]/chromadb/__init__.py:420 
    tenant = tenant or os.environ.get("CHROMA_TENANT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59c2cd162caa429c — Environment-variable access.
pkgs/python/[email protected]/chromadb/__init__.py:423 
    database = database or os.environ.get("CHROMA_DATABASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afcd56c27c01ad0a — Filesystem access.
pkgs/python/[email protected]/chromadb/auth/__init__.py:124 
            with open(_creds_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c7efe7236ec5214 — Filesystem access.
pkgs/python/[email protected]/chromadb/auth/__init__.py:235 
            with open(_config_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #465948d95dbdaa73 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/cli/cli.py:25 
        response = requests.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #2c5eb3f7a4e31966 — Filesystem access.
pkgs/python/[email protected]/chromadb/cli/utils.py:12 
    with open(f"{log_config_path}", "r") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cab293af75ff4d07 — Filesystem access.
pkgs/python/[email protected]/chromadb/db/migrations.py:256 
    sql = file["path"].read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92ef079c4b9c8989 — Filesystem access.
pkgs/python/[email protected]/chromadb/segment/impl/vector/local_persistent_hnsw.py:74 
        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70cfdce97937adae — Filesystem access.
pkgs/python/[email protected]/chromadb/segment/impl/vector/local_persistent_hnsw.py:255 
        with open(self._get_metadata_file(), "wb") as metadata_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b74b9a678290b3a5 — Environment-variable access.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:139 
                        {"pod_name": os.environ.get("HOSTNAME")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #007a577ccdc0acc4 — Environment-variable access.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:155 
                        {"pod_name": os.environ.get("HOSTNAME")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72e39da2924db6e3 — Filesystem access.
pkgs/python/[email protected]/chromadb/telemetry/product/__init__.py:88 
                with open(self.USER_ID_PATH, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3af4ca0e505e1f1a — Filesystem access.
pkgs/python/[email protected]/chromadb/telemetry/product/__init__.py:93 
                with open(self.USER_ID_PATH, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75ab700d26a6bcb1 — Environment-variable access.
pkgs/python/[email protected]/chromadb/telemetry/product/events.py:20 
        self.is_cli = os.environ.get("CHROMA_CLI", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff03f46d65954472 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/baseten_embedding_function.py:39 
        if os.getenv("BASETEN_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7800b539069c0db6 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/baseten_embedding_function.py:45 
        resolved_api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee3857b516b615f5 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_qwen_embedding_function.py:61 
        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fda155b05df6d66 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_splade_embedding_function.py:42 
        self.api_key = os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c97be2016c8af75 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:57 
        if os.getenv("CLOUDFLARE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8eca29964f90eccd — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:62 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c49fdf2480db73b — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cohere_embedding_function.py:46 
        if os.getenv("COHERE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0932b82cf60a18fa — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cohere_embedding_function.py:51 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94daa404d351de7a — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:57 
        self.api_key = os.getenv(self.api_key_env_var) if self.api_key_env_var else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b1ccc78b566fc71 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:251 
        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43f6e0c5e656cac6 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:256 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f46b81b9ab9cd75f — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:401 
        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fad62ada73ca52b1 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:406 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2506816d6d1b6ea2 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:529 
        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2762532801b02029 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:534 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97e69758d25a8983 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:43 
        if os.getenv("HUGGINGFACE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ea1a447020a16b4 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:48 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6dbd80c2a13f56b9 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:169 
        if os.getenv("HUGGINGFACE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa68f82361e07a9d — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:173 
            self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85bc178b994bafd0 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:84 
        if os.getenv("JINA_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e0171d1439818a2 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:89 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c413fc8b4538820b — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/mistral_embedding_function.py:29 
        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ef87dedf988aaa5 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/morph_embedding_function.py:49 
        self.api_key = api_key or os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02ddb8dab9bcfe8b — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/nomic_embedding_function.py:50 
        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6bdf8185252a736 — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/onnx_mini_lm_l6_v2.py:24 
    with open(fname, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f20ec864604afcf — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/onnx_mini_lm_l6_v2.py:109 
            with open(fname, "wb") as file, self.tqdm(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #821665712c8cbef6 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/openai_embedding_function.py:60 
        if os.getenv("OPENAI_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abdb6a562abcc462 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/openai_embedding_function.py:65 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a50dc88983da01e — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/perplexity_embedding_function.py:52 
        if os.getenv("PERPLEXITY_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b17b806cee0f930 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/perplexity_embedding_function.py:57 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f96ee1266fd33e05 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:48 
        if os.getenv("ROBOFLOW_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de9e1e0171e32f0d — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:53 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3d4f35ccd6b11ff — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/schemas/registry.py:38 
        with open(schema_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa103925872cf71f — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/schemas/schema_utils.py:36 
    with open(schema_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38cd171f1bc58058 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:52 
        if os.getenv("TOGETHER_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0dd1b0ae60d5b51 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:57 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc16c518d8e944b0 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/utils.py:11 
    return (os.environ.get("CHROMA_EMBED_URL") or DEFAULT_CHROMA_EMBED_URL).rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4b4de222352e4e3 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/voyageai_embedding_function.py:50 
        if os.getenv("VOYAGE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb606d4e88138e26 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/voyageai_embedding_function.py:55 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redis

python dependency
medium telemetry dependency Excluded from app score #8e608a32a319ff80 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/asyncio/observability/recorder.py:247 
        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ba9f0acd69e5f2a0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/metrics.py:37 
    from opentelemetry.metrics import Meter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #92ddc58226b1cadf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/providers.py:32 
    from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ad3513fd73839631 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/providers.py:76 
            from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c17491b065fe324b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/providers.py:77 
            from opentelemetry.metrics import NoOpMeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0643752fae848b33 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/recorder.py:242 
        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f51bd1d73be1efbe — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/recorder.py:727 
    from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0a35fdef9f3352b9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/registry.py:8 
        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #86e1478d573a8fe8 — Filesystem access.
pkgs/python/[email protected]/redis/commands/json/__init__.py:303 
            with open(fp) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c7211659b3914a2 — Filesystem access.
pkgs/python/[email protected]/redis/commands/json/commands.py:650 
        with open(file_name) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

accelerate

python dependency
medium telemetry dependency Excluded from app score #d2bc75f35bf6d666 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/accelerate/tracking.py:654 
            self.writer.track(value, name=key, step=step, **kwargs)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b9a3ea3cf2ddeca9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/accelerate/tracking.py:686 
            self.writer.track(aim_image, name=key, step=step, **track_kw)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 225 low-confidence finding(s)
low env_fs dependency Excluded from app score #33bf5671a045f5df — Filesystem access.
pkgs/python/[email protected]/setup.py:61 
    long_description=open("README.md", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e386d8960e439c5c — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:346 
                    if os.environ.get("ACCELERATE_USE_DEEPSPEED", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba5758eaf19b4e1c — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:366 
            os.environ["ACCELERATE_USE_DEEPSPEED"] = "true"  # use DeepSpeed if plugin is provided

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12df8c78605be4f8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:380 
        if os.environ.get("ACCELERATE_USE_FSDP", "false").lower() == "true" or isinstance(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6843dc39aa55bee — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:389 
                if os.environ.get("ACCELERATE_USE_FSDP", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cc293925c7c615e — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:395 
            os.environ["ACCELERATE_USE_FSDP"] = "true"  # use FSDP if plugin is provided

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bab1b4a443585450 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:403 
                MegatronLMPlugin() if os.environ.get("ACCELERATE_USE_MEGATRON_LM", "false").lower() == "true" else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a309249e133c5f80 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:408 
            os.environ["ACCELERATE_USE_MEGATRON_LM"] = "true"  # use MegatronLM if plugin is provided

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #888832234cbc2cce — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:457 
            elif os.environ.get("ACCELERATE_USE_PARALLELISM_CONFIG", "false").lower() == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30a010ba2a6c1779 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:1474 
                and os.environ.get("ACCELERATE_BYPASS_DEVICE_MAP", "false") != "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6825eb1813586eea — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:1800 
            and os.environ.get("ACCELERATE_BYPASS_DEVICE_MAP", "false") != "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a96522982a3f4762 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:1874 
                    if os.environ.get("ACCELERATE_BYPASS_DEVICE_MAP", "false") != "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3f2de74f5e5f532 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:2356 
                        if self.device.type == "hpu" and os.environ.get("PT_HPU_LAZY_MODE", "1") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92e721f181bcef6c — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:2371 
                os.environ["DEEPSPEED_USE_HPU"] = "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92ca78662317126e — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:2988 
            if os.environ.get("ACCELERATE_USE_FSDP", "false").lower() == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e6209e594d7d01b — Filesystem access.
pkgs/python/[email protected]/src/accelerate/accelerator.py:3523 
            with open(save_index_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afcdada59c2a8f33 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/commands/config/config_args.py:30 
    os.environ.get("HF_HOME", os.path.join(os.environ.get("XDG_CACHE_HOME", "~/.cache"), "huggingface"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a9876f4dbbc1c16 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/config/config_args.py:54 
    with open(config_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61e6b47eb73e642f — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/config/config_args.py:131 
        with open(json_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bd905b3ccc515c2 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/config/config_args.py:144 
        with open(json_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d792ccdb4b83b040 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/config/config_args.py:151 
        with open(yaml_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #386a0124b3652c10 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/config/config_args.py:163 
        with open(yaml_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d660f33f9433750 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/commands/config/sagemaker.py:106 
        os.environ["AWS_PROFILE"] = aws_profile

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52919f4c5ff04b26 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/commands/config/sagemaker.py:113 
        os.environ["AWS_ACCESS_KEY_ID"] = aws_access_key_id

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16e70e075ab8e896 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/commands/config/sagemaker.py:116 
        os.environ["AWS_SECRET_ACCESS_KEY"] = aws_secret_access_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9704c33b41a3e1d1 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/commands/config/sagemaker.py:119 
    os.environ["AWS_DEFAULT_REGION"] = aws_region

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d028ed25163ba01e — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/launch.py:1055 
        with open(DEEPSPEED_ENVIRONMENT_NAME, "a") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3258a81eac588444 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/to_fsdp2.py:154 
    with open(config_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e089419e7cc3f403 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/to_fsdp2.py:171 
    with open(args.output_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0977f049a8709ede — Filesystem access.
pkgs/python/[email protected]/src/accelerate/commands/tpu.py:115 
        with open(args.command_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e9576cb987f460b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/launchers.py:124 
    if any(key.startswith("KAGGLE") for key in os.environ.keys()):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80e753ccb1c8ccb9 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/launchers.py:137 
        (os.environ.get("TPU_NAME", None) is not None) or (os.environ.get("PJRT_DEVICE", "") == "TPU")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e5b89b13554fd9c — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/launchers.py:211 
                if os.environ.get("ACCELERATE_DEBUG_MODE", "false").lower() == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3da6617908b2656b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/launchers.py:265 
                os.environ["PYTORCH_ENABLE_MPS_FALLBACK"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfb434c0647b035f — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/logging.py:128 
        log_level = os.environ.get("ACCELERATE_LOG_LEVEL", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4633fc771cbaf06d — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/parallelism_config.py:277 
            self.dp_replicate_size = int(os.environ.get("PARALLELISM_CONFIG_DP_REPLICATE_SIZE", "1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d836d0bd1bf5566 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/parallelism_config.py:279 
            self.dp_shard_size = int(os.environ.get("PARALLELISM_CONFIG_DP_SHARD_SIZE", "1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #237b32f6c13bc5de — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/parallelism_config.py:281 
            self.tp_size = int(os.environ.get("PARALLELISM_CONFIG_TP_SIZE", "1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38faa96b34468aef — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/parallelism_config.py:283 
            self.cp_size = int(os.environ.get("PARALLELISM_CONFIG_CP_SIZE", "1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #432dd1ed2aa8bf51 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/parallelism_config.py:285 
            self.cp_backend = os.environ.get("PARALLELISM_CONFIG_CP_BACKEND", "torch")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b32f10606bf41360 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/parallelism_config.py:287 
            self.sp_size = int(os.environ.get("PARALLELISM_CONFIG_SP_SIZE", "1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #081c4b5efea011d3 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/parallelism_config.py:289 
            self.sp_backend = os.environ.get("PARALLELISM_CONFIG_SP_BACKEND", "deepspeed")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62fbfca5195d86e3 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:182 
            env_device = os.environ.get("ACCELERATE_TORCH_DEVICE", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdef788641af9459 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:189 
                    os.environ.get("ACCELERATE_USE_SAGEMAKER", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #feb7c8279745afe4 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:190 
                    and os.environ.get("ACCELERATE_SAGEMAKER_DISTRIBUTED_TYPE") != SageMakerDistributedType.NO

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #587520bc88ae55bd — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:202 
                if int(os.environ.get("LOCAL_RANK", -1)) != -1:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #592df549f1a4e8bb — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:204 
                    if os.environ.get("ACCELERATE_USE_DEEPSPEED", "false").lower() == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce7165c64449e064 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:213 
                                local_rank = os.environ.get("LOCAL_RANK", -1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f99c720f34ecb8d — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:224 
                            local_rank = os.environ.get("LOCAL_RANK", -1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf570cb94a3035d6 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:228 
                            and os.environ.get("ACCELERATE_USE_FSDP", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63f76174f8182bc1 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:230 
                                os.environ.get("FSDP_OFFLOAD_PARAMS", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #964ae4bc470ee296 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:231 
                                or os.environ.get("FSDP_STATE_DICT_TYPE", "SHARDED_STATE_DICT") == "FULL_STATE_DICT"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9492667df6f639f8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:237 
                            and os.environ.get("ACCELERATE_USE_FSDP", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca5f7e75f37d397d — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:239 
                                os.environ.get("FSDP_OFFLOAD_PARAMS", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97c7bfad0e6b1c76 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:240 
                                or os.environ.get("FSDP_STATE_DICT_TYPE", "SHARDED_STATE_DICT") == "FULL_STATE_DICT"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d50ab3b3deb1e2bf — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:249 
                os.environ["RANK"] = str(dist_information.rank)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8700fef25fdbbb2f — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:250 
                os.environ["WORLD_SIZE"] = str(dist_information.world_size)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35a79660e9637112 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:251 
                os.environ["LOCAL_RANK"] = str(dist_information.local_rank)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e237fd68db9fb519 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:252 
                os.environ["LOCAL_WORLD_SIZE"] = str(dist_information.local_world_size)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8cc14f64418a1cd — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:253 
                if not os.environ.get("MASTER_PORT", None):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f0632d12bea89dc — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:254 
                    os.environ["MASTER_PORT"] = "29500"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #715b0f94677a12a1 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:256 
                    not os.environ.get("MASTER_ADDR", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3102fdf489f5054 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:302 
                    self.local_process_index = int(os.environ.get("LOCAL_RANK", -1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c275d9b69c092d07 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:307 
                    int(os.environ.get("LOCAL_RANK", -1)) if dist_information is None else dist_information.local_rank

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abac47245884f562 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:320 
                if "NCCL_P2P_DISABLE" not in os.environ or "NCCL_IB_DISABLE" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a68e7aacea6b4cde — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:735 
            os.environ["PYTORCH_ENABLE_MPS_FALLBACK"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e991380d6693920 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:772 
        elif int(os.environ.get("LOCAL_RANK", -1)) != -1 and not cpu:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c37e8d0503d0933 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:807 
                int(os.environ.get("LOCAL_RANK", -1)) != -1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce4d0a204746eb89 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:967 
                    if os.environ.get("ACCELERATE_DOWNCAST_BF16"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc5859b9c53b4cd9 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:968 
                        os.environ["XLA_USE_BF16"] = str(0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b9660d31b9dc321 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:969 
                        os.environ["XLA_DOWNCAST_BF16"] = str(1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfada0c1452de109 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:972 
                        os.environ["XLA_USE_BF16"] = str(1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a3c0b5903abdb12 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:973 
                        os.environ["XLA_DOWNCAST_BF16"] = str(0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #662bcf81ab56789b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:975 
            elif os.environ.get("ACCELERATE_USE_DEEPSPEED", "false").lower() == "true" and not cpu:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1d96ebe6e4e6c8a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:998 
                if not os.environ.get("ACCELERATE_ALLOW_CP_STANDALONE", "false").lower() == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c29744e1570b8d9 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:1011 
                if (os.environ.get("ACCELERATE_USE_FSDP", "false").lower() == "true" or fsdp_plugin is not None) or (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b202864a10acc379 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:1018 
                if os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8ed7877a848f18f — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/state.py:1018 
                if os.environ.get(
                    "ACCELERATE_USE_MEGATRON_LM", "false"
                ).lower() == "true" and self.distributed_type not in [

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cdf190e126ed289 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/examples.py:89 
    with open(base_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbe2ebaa82f3fb96 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/examples.py:91 
    with open(os.path.abspath(os.path.join("examples", "nlp_example.py"))) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31d88fd570b84709 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/examples.py:93 
    with open(feature_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f545647f55d77688 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/examples.py:96 
        with open(secondary_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6799d2cd5a737e3b — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/external_deps/test_checkpointing.py:184 
        with open(os.path.join(args.output_dir, f"state_{starting_epoch - 1}.json")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c3e66d375e8d4b02 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/external_deps/test_checkpointing.py:224 
            with open(os.path.join(args.output_dir, f"state_{epoch}.json"), "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #16a7e78e7f2e2219 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/external_deps/test_metrics.py:34 
os.environ["TRANSFORMERS_NO_ADVISORY_WARNINGS"] = "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4390d7d1770442b2 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/external_deps/test_peak_memory_usage.py:273 
        with open(os.path.join(args.output_dir, "peak_memory_utilization.json"), "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bca9309fc6399192 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/external_deps/test_performance.py:233 
        with open(os.path.join(args.output_dir, "all_results.json"), "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #11636f7e28731b0b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/test_notebook.py:53 
NUM_PROCESSES = int(os.environ.get("ACCELERATE_NUM_PROCESSES", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7c59ca79990d4cb0 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/test_script.py:96 
            with open(path, "a+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a0fbb76c718df37e — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/test_script.py:99 
            with open(path, "a+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #11a8003feb8f7ca2 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/test_utils/scripts/test_script.py:104 
        with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54cc7e6cbf2df6a4 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/test_utils/testing.py:138 
        value = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #441bad5f291320b3 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/test_utils/testing.py:798 
    worker = os.environ.get("PYTEST_XDIST_WORKER", "gw0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06305218d2ff32b4 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/test_utils/testing.py:829 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89bbcc69afc3d0ab — Filesystem access.
pkgs/python/[email protected]/src/accelerate/tracking.py:237 
        with open(os.path.join(dir_name, "hparams.yml"), "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcc6f6a36a2d40f8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/tracking.py:737 
        experiment_name = os.environ.get("MLFLOW_EXPERIMENT_NAME", experiment_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f24c5daf9d4b68a3 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/tracking.py:738 
        run_id = os.environ.get("MLFLOW_RUN_ID", run_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fe244636e75b42d4 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/tracking.py:739 
        tags = os.environ.get("MLFLOW_TAGS", tags)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b39dc440bcd0f0e7 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/tracking.py:743 
        nested_run = os.environ.get("MLFLOW_NESTED_RUN", nested_run)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d328b0d12ed2290 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/tracking.py:935 
        task_init_args.setdefault("project_name", os.environ.get("CLEARML_PROJECT", self.user_provided_run_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a6b5764c6762f5c — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/tracking.py:936 
        task_init_args.setdefault("task_name", os.environ.get("CLEARML_TASK", self.user_provided_run_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27b841d34be222f2 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:413 
            self.margin = int(os.environ.get(env_prefix + "MARGIN", 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4732a8263007d3a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:415 
            self.interval = int(os.environ.get(env_prefix + "INTERVAL", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95bc1f910b1b23b2 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:417 
            self.fp8_format = os.environ.get(env_prefix + "FORMAT", "HYBRID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29b1731dacc9296b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:422 
            self.amax_compute_algo = os.environ.get(env_prefix + "AMAX_COMPUTE_ALGO", "most_recent")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f696c2b001de18aa — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:427 
            self.amax_history_len = int(os.environ.get(env_prefix + "AMAX_HISTORY_LEN", 1024))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fe4bab4fbd0c44b3 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:449 
            self.opt_level = os.environ.get(env_prefix + "OPT_LEVEL", "O2")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f01f908a7ff950a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:472 
            self.backend = os.environ.get(env_prefix + "BACKEND", default_backend)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fb18b6ced25f452 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1089 
            self.backend = os.environ.get(prefix + "BACKEND", "no")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2a7f16081003c43 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1093 
            self.mode = os.environ.get(prefix + "MODE", "default")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1981f4b585772c38 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1095 
            self.fullgraph = str_to_bool(os.environ.get(prefix + "USE_FULLGRAPH", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #880638ebd6fc3163 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1098 
                str_to_bool(os.environ.get(prefix + "USE_REGIONAL_COMPILATION", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb1f93569fcabc24 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1101 
        if self.dynamic is None and os.environ.get(prefix + "USE_DYNAMIC", None) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c5cc1aab7c459e3 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1102 
            self.dynamic = str_to_bool(os.environ.get(prefix + "USE_DYNAMIC", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #986afe90ad311f34 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1224 
            gas = os.environ.get("ACCELERATE_GRADIENT_ACCUMULATION_STEPS", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fe3f72aaee3ee1f0 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1228 
            gradient_clipping = os.environ.get("ACCELERATE_GRADIENT_CLIPPING", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abab0e409fd22059 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1232 
            self.zero_stage = int(os.environ.get("ACCELERATE_DEEPSPEED_ZERO_STAGE", 2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ea3795bf3aca8f9 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1235 
            self.offload_optimizer_device = os.environ.get("ACCELERATE_DEEPSPEED_OFFLOAD_OPTIMIZER_DEVICE", "none")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfe556bb747c92f8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1238 
            self.offload_param_device = os.environ.get("ACCELERATE_DEEPSPEED_OFFLOAD_PARAM_DEVICE", "none")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2037b8b8ef631a94 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1241 
            self.offload_optimizer_nvme_path = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f45fb3d1c278a25e — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1241 
            self.offload_optimizer_nvme_path = os.environ.get(
                "ACCELERATE_DEEPSPEED_OFFLOAD_OPTIMIZER_NVME_PATH", "none"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b79dba28c30fecfa — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1246 
            self.offload_param_nvme_path = os.environ.get("ACCELERATE_DEEPSPEED_OFFLOAD_PARAM_NVME_PATH", "none")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b6e7b0c2c6a6c2a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1250 
                os.environ.get("ACCELERATE_DEEPSPEED_ZERO3_SAVE_16BIT_MODEL", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6ddee81367d7058 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1253 
            self.enable_msamp = os.environ.get("ACCELERATE_FP8_BACKEND", None) == "MSAMP"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f19c0e96d1a385e8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1256 
            self.msamp_opt_level = os.environ.get("ACCELERATE_FP8_OPT_LEVEL", "O1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78ea763c3400f1ad — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1259 
            self.hf_ds_config = os.environ.get("ACCELERATE_DEEPSPEED_CONFIG_FILE", "none")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a5b4bd9dbe16a7b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1324 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15b2599e2c7bcc35 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1324 
                    os.environ.get(
                        "ACCELERATE_DEEPSPEED_ZERO3_INIT",
                        str(self.hf_ds_config.is_zero3()),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a726fbb059d193bc — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1506 
        deepspeed_fields_from_accelerate_config = os.environ.get("ACCELERATE_CONFIG_DS_FIELDS", "").split(",")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79dfb2c5fe85f723 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1519 
            self.transformer_moe_cls_names = os.environ.get("ACCELERATE_DEEPSPEED_MOE_LAYER_CLS_NAMES", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69c0bce8386e1e40 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1806 
            self.fsdp_version = int(os.environ.get(env_prefix + "VERSION", "1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d1cd6d4436685ca — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1821 
                self.sharding_strategy = os.environ.get(env_prefix + "SHARDING_STRATEGY", "FULL_SHARD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #863b1d16e01c0340 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1832 
            reshard_after_forward = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63b00ac7d76f502b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1832 
            reshard_after_forward = os.environ.get(
                env_prefix + "RESHARD_AFTER_FORWARD",
                "true" if self.fsdp_version == 2 else "FULL_SHARD",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3bfd7c6e355f8d8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1862 
            self.cpu_offload = str_to_bool(os.environ.get(env_prefix + "OFFLOAD_PARAMS", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2829cb11f7197053 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1868 
            self.backward_prefetch = os.environ.get(env_prefix + "BACKWARD_PREFETCH", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #caedb3c7e416296f — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1885 
            self.auto_wrap_policy = os.environ.get(env_prefix + "AUTO_WRAP_POLICY", "NO_WRAP")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1535d55152b3f704 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1899 
                    self.transformer_cls_names_to_wrap = os.environ.get(env_prefix + "TRANSFORMER_CLS_TO_WRAP", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b2a7fdb954fe7df — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1905 
                    self.min_num_params = int(os.environ.get(env_prefix + "MIN_NUM_PARAMS", 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d616352ac2d6076b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1914 
            self.use_orig_params = str_to_bool(os.environ.get(env_prefix + "USE_ORIG_PARAMS", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed51dd2be954633e — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1920 
            self.sync_module_states = str_to_bool(os.environ.get(env_prefix + "SYNC_MODULE_STATES", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2b59eb1315cd58b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1929 
            self.forward_prefetch = str_to_bool(os.environ.get(env_prefix + "FORWARD_PREFETCH", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b45892f20691254a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1935 
                str_to_bool(os.environ.get(env_prefix + "ACTIVATION_CHECKPOINTING", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7242890b1c59faf2 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1939 
            self.ignored_modules = os.environ.get(env_prefix + "IGNORED_MODULES", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8141bce22f763b9 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1943 
                str_to_bool(os.environ.get(env_prefix + "CPU_RAM_EFFICIENT_LOADING", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6cad3b3a0c00d98 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:1947 
            os.environ[env_prefix + "CPU_RAM_EFFICIENT_LOADING"] = str(self.cpu_ram_efficient_loading)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71e98001c07e0064 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2012 
            self.state_dict_type = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03d94221addf740d — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2012 
            self.state_dict_type = os.environ.get(
                "FSDP_STATE_DICT_TYPE",
                "FULL_STATE_DICT" if self.fsdp_version == 1 else "SHARDED_STATE_DICT",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0a456358df616f1 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2209 
            self.cp_comm_strategy = os.environ.get("PARALLELISM_CONFIG_CP_COMM_STRATEGY", "allgather")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78e342fe261ac053 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2241 
                os.environ.get("PARALLELISM_CONFIG_SP_SEQ_LENGTH_IS_VARIABLE", "true").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #940203c8197dce77 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2245 
            if "PARALLELISM_CONFIG_SP_SEQ_LENGTH" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #270cb039daa8dd50 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2250 
                self.sp_seq_length = os.environ.get("PARALLELISM_CONFIG_SP_SEQ_LENGTH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c22cffb1fdb6fbc — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2254 
            self.sp_attn_implementation = os.environ.get("PARALLELISM_CONFIG_SP_ATTN_IMPLEMENTATION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d6b1014a7367971 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2584 
            self.tp_degree = int(os.environ.get(prefix + "TP_DEGREE", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d16bd2b4002781a7 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2586 
            self.pp_degree = int(os.environ.get(prefix + "PP_DEGREE", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b50b478365aabb2 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2588 
            self.use_custom_fsdp = str_to_bool(os.environ.get(prefix + "USE_CUSTOM_FSDP", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b34b500917e96d7e — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2590 
            self.no_load_optim = str_to_bool(os.environ.get(prefix + "NO_LOAD_OPTIM", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b251e77e6067fae — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2592 
            self.eod_mask_loss = str_to_bool(os.environ.get(prefix + "EOD_MASK_LOSS", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #031f6d3670b29fe1 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2594 
            self.no_save_optim = str_to_bool(os.environ.get(prefix + "NO_SAVE_OPTIM", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5cd8d6b1bfe3934 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2596 
            self.optimizer_cpu_offload = str_to_bool(os.environ.get(prefix + "OPTIMIZER_CPU_OFFLOAD", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e50adc278ecab6cf — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2599 
                str_to_bool(os.environ.get(prefix + "OVERLAP_CPU_OPTIMIZER_D2H_H2D", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55e7d11e48732146 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2603 
                str_to_bool(os.environ.get(prefix + "USE_PRECISION_AWARE_OPTIMIZER", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b844dbe53625bcb5 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2606 
            if os.environ.get(prefix + "DECODER_LAST_PIPELINE_NUM_LAYERS") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #349c6cf87edba098 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2608 
                    os.environ.get(prefix + "DECODER_LAST_PIPELINE_NUM_LAYERS", 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c4d9fcab3a51ec1 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2613 
            self.num_micro_batches = int(os.environ.get(prefix + "NUM_MICRO_BATCHES", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d87e42206cab77a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2615 
            self.gradient_clipping = float(os.environ.get(prefix + "GRADIENT_CLIPPING", 1.0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #062db92dd5274545 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2617 
            self.recompute_activations = str_to_bool(os.environ.get(prefix + "RECOMPUTE_ACTIVATIONS", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91e9aa6a71502dd2 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2620 
                str_to_bool(os.environ.get(prefix + "USE_DISTRIBUTED_OPTIMIZER", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee6b4797fd6774e3 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2623 
            self.sequence_parallelism = str_to_bool(os.environ.get(prefix + "SEQUENCE_PARALLELISM", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fdcb27ee83319a0 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2625 
            self.recompute_granularity = os.environ.get(prefix + "RECOMPUTE_GRANULARITY", "full")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33a5160095033cf8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2627 
            self.recompute_method = os.environ.get(prefix + "RECOMPUTE_METHOD", "uniform")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ab7f49f93837efe — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2629 
            self.recompute_num_layers = int(os.environ.get(prefix + "RECOMPUTE_NUM_LAYERS", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd3fe749abedfb0b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2631 
            self.attention_backend = str_to_bool(os.environ.get(prefix + "ATTENTION_BACKEND", "True")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fd3bf3eb538dbbf — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2633 
            self.expert_model_parallel_size = int(os.environ.get(prefix + "EXPERT_MODEL_PARALLEL_SIZE", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e49798e2d987f96 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2635 
            self.context_parallel_size = int(os.environ.get(prefix + "CONTEXT_PARALLEL_SIZE", 2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f062ee1ed776d8d — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2637 
            self.attention_dropout = float(os.environ.get(prefix + "ATTENTION_DROPOUT", "0.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3881430bb699c74b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2639 
            self.hidden_dropout = float(os.environ.get(prefix + "HIDDEN_DROPOUT", "0.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb1b0512d6c40b71 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2642 
                str_to_bool(os.environ.get(prefix + "ATTENTION_SOFTMAX_IN_FP32", "True")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fbf243b24617b64 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2645 
            self.expert_tensor_parallel_size = int(os.environ.get(prefix + "EXPERT_TENSOR_PARALLEL_SIZE", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03ba1fe23fd9d9fb — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2648 
                str_to_bool(os.environ.get(prefix + "CALCULATE_PER_TOKEN_LOSS", "True")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #003535d2851bb606 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/dataclasses.py:2652 
                str_to_bool(os.environ.get(prefix + "USE_ROTARY_POSITION_EMBEDDINGS", "True")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18c9991f4a185ed6 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/utils/deepspeed.py:142 
            with open(config_file_or_dict, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f6f651a19424500 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:77 
        val = int(os.environ.get(e, -1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #740db75f0dafdeb0 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:85 
    value = os.environ.get(key, str(default))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #412304f588d4c11a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:90 
    value = os.environ.get(key, str(default))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa6fbf8236848d92 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:163 
            command = f"{os.environ['systemdrive']}\\Program Files\\NVIDIA Corporation\\NVSMI\\nvidia-smi.exe"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3c21fde0bdba62a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:368 
    _old_os_environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bfa3410b494cd3b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:369 
    os.environ.clear()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f746ce629192f17 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:374 
        os.environ.clear()  # clear any added keys,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5f314f11d675bd7 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:375 
        os.environ.update(_old_os_environ)  # then restore previous environment

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1aafafde4e9fc3ac — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:399 
        if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b9522a900cb58e9 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:400 
            existing_vars[key] = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28ef5cb691691711 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:401 
        os.environ[key] = str(value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7eeba26e45fc470 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:410 
                os.environ[key] = existing_vars[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2065a1d153e194fc — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:412 
                os.environ.pop(key, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db6184762cb8911a — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:439 
        existing_vars = {k: v for k, v in os.environ.items() if k.startswith(prefix)}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bbde77dc3c121c0 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:444 
            for key in [k for k in os.environ if k.startswith(prefix)]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86e38a7a281963dc — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:446 
                    os.environ[key] = existing_vars[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dc2494fd91d8ae9 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/environment.py:448 
                    os.environ.pop(key, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8abf5146f7fb33ac — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/fsdp_utils.py:44 
    if "ACCELERATE_USE_FSDP" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f2bb41817329302 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/fsdp_utils.py:45 
        os.environ["ACCELERATE_USE_FSDP"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fadfd79f67a67de8 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/fsdp_utils.py:46 
    os.environ["FSDP_CPU_RAM_EFFICIENT_LOADING"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #334ba61f3a7a48df — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/fsdp_utils.py:53 
    os.environ["FSDP_CPU_RAM_EFFICIENT_LOADING"] = "False"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5755700f58dc3a9e — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/imports.py:222 
    if str_to_bool(os.environ.get("ACCELERATE_USE_MEGATRON_LM", "False")) == 1:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b44d9f2b8f92816f — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:132 
    current_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cab80816a58a02e — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:257 
    current_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ce12b3f5fe6c890 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:528 
    current_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89d26001bf2e3d97 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:660 
    os.environ["AWS_DEFAULT_REGION"] = sagemaker_config.region

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e57b7762c2c82579 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:664 
        os.environ["AWS_PROFILE"] = sagemaker_config.profile

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a15674704741819 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:666 
        os.environ["AWS_ACCESS_KEY_ID"] = args.aws_access_key_id

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2cefb3d72e2ff7f0 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:667 
        os.environ["AWS_SECRET_ACCESS_KEY"] = args.aws_secret_access_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5380bedc545fb59 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:723 
        with open(sagemaker_config.sagemaker_inputs_file) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #209579ded9b33b7c — Filesystem access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:736 
        with open(sagemaker_config.sagemaker_metrics_file) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11f0851f7efb1f31 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:778 
    paths = [p for p in os.environ.get(env_var_name, "").split(":") if len(p) > 0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46308b1a326d0965 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:803 
            world_size = int(os.environ.get("WORLD_SIZE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6217bdccc7f294be — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:804 
            rdv_file = os.environ.get("ACCELERATE_DEBUG_RDV_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3fd838a188da5f2 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:821 
            os.environ["LOCAL_RANK"] = str(index)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fc82ce35ce5ad71 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:822 
            nproc = int(os.environ.get("NPROC", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5a5afba9bc6736c — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:823 
            node_rank = int(os.environ.get("NODE_RANK", 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #deee016ab387709b — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:824 
            os.environ["RANK"] = str(nproc * node_rank + index)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89ff67b5ba9d9837 — Environment-variable access.
pkgs/python/[email protected]/src/accelerate/utils/launch.py:826 
        os.environ["FORK_LAUNCHED"] = str(1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5f77e32172437b1 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/utils/modeling.py:1909 
        with open(index_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e53f54804f36d62 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/utils/offload.py:75 
        with open(offload_index_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b50afc468f5b8f7 — Filesystem access.
pkgs/python/[email protected]/src/accelerate/utils/offload.py:81 
    with open(offload_index_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e84766e3c7319a4c — Filesystem access.
pkgs/python/[email protected]/src/accelerate/utils/offload.py:154 
            with open(os.path.join(save_folder, "index.json")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

APScheduler

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #1e760ff80c23812d — Filesystem access.
pkgs/python/[email protected]/src/apscheduler/schedulers/base.py:832 
                outfile = stack.enter_context(open(outfile, "w"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb86d408ed71ce86 — Filesystem access.
pkgs/python/[email protected]/src/apscheduler/schedulers/base.py:873 
                infile = stack.enter_context(open(infile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Brotli

python dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #5fc1d82fd220570c — Filesystem access.
pkgs/python/[email protected]/python/bro.py:152 
            with open(options.infile, 'rb') as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8de2a058dc36d78 — Filesystem access.
pkgs/python/[email protected]/python/bro.py:169 
        outfile = open(options.outfile, 'wb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #514d587a4c7b3822 — Environment-variable access.
pkgs/python/[email protected]/setup.py:28 
    value = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b896ff54415283a8 — Filesystem access.
pkgs/python/[email protected]/setup.py:40 
    with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0db9d9cca0c269dc — Filesystem access.
pkgs/python/[email protected]/setup.py:335 
with open("README.md", "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

PyJWT

python dependency
expand_more 4 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #1f4415dec6dadcb6 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:11 
    with open(os.path.join(here, *parts), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d46c2a4c09013e62 — Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:97 
os.environ["SPHINX_BUILD"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f1b51b4752cf185 — Environment-variable access.
pkgs/python/[email protected]/jwt/algorithms.py:102 
    if TYPE_CHECKING or bool(os.getenv("SPHINX_BUILD", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65f798e92ea9c2db — Environment-variable access.
pkgs/python/[email protected]/jwt/api_jwt.py:25 
if TYPE_CHECKING or bool(os.getenv("SPHINX_BUILD", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

PyMySQL

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #ad43940d416fa43a — Filesystem access.
pkgs/python/[email protected]/pymysql/connections.py:1460 
            with open(self.filename, "rb") as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

aiocache

python dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #7bb2ece674fa8dc3 — Environment-variable access.
pkgs/python/[email protected]/aiocache/base.py:62 
                if os.getenv("AIOCACHE_DISABLE") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #07348092e167730f — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:70 
    version = re.findall(r'__version__ = "(.+?)"', _path.read_text())[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7afde8ffc714f99c — Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:134 
on_rtd = os.environ.get("READTHEDOCS", None) == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fea29a094338620 — Filesystem access.
pkgs/python/[email protected]/setup.py:8 
    version = re.findall(r"^__version__ = \"([^']+)\"\r?$", p.read_text(), re.M)[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f22b45884ee87d41 — Filesystem access.
pkgs/python/[email protected]/setup.py:12 
readme = Path(__file__).with_name("README.rst").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

aiohttp

python dependency
expand_more 17 low-confidence finding(s)
low env_fs dependency Excluded from app score #255c826d4745fab5 — Environment-variable access.
pkgs/python/[email protected]/aiohttp/helpers.py:78 
NO_EXTENSIONS = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7a7eb58a4bbb69b — Environment-variable access.
pkgs/python/[email protected]/aiohttp/helpers.py:87 
    not sys.flags.ignore_environment and bool(os.environ.get("PYTHONASYNCIODEBUG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c03ea400d15e45c — Environment-variable access.
pkgs/python/[email protected]/aiohttp/helpers.py:204 
    netrc_env = os.environ.get("NETRC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30810677e4ce6b5e — Environment-variable access.
pkgs/python/[email protected]/aiohttp/web_fileresponse.py:50 
NOSENDFILE: Final[bool] = bool(os.environ.get("AIOHTTP_NOSENDFILE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #31a970522c37926f — Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:22 
    os.getenv("READTHEDOCS", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2295ab08d8fd4713 — Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:23 
    and os.environ["READTHEDOCS_VERSION_TYPE"] == "tag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #184500ece380a955 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:32 
with open(_version_path, encoding="latin1") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6605d89277cf1c75 — Filesystem access.
pkgs/python/[email protected]/examples/web_ws.py:21 
        with open(WS_FILE, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #373194e433cf1fc2 — Filesystem access.
pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:12 
data = tomllib.loads(Path("pyproject.toml").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e660f7a75fa75a9e — Filesystem access.
pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:19 
with open(Path("requirements", "runtime-deps.in"), "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1aabc3acab315b41 — Environment-variable access.
pkgs/python/[email protected]/setup.py:12 
    os.environ.get("AIOHTTP_USE_SYSTEM_DEPS", os.environ.get("USE_SYSTEM_DEPS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a84bd04a7bddf6a6 — Environment-variable access.
pkgs/python/[email protected]/setup.py:14 
NO_EXTENSIONS: bool = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bcce94708b8fbb99 — Filesystem access.
pkgs/python/[email protected]/tools/check_sum.py:30 
        hasher.update(full_src.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #17d5e8dafbef01d0 — Filesystem access.
pkgs/python/[email protected]/tools/check_sum.py:37 
        dst_hash = dst.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a66c5bc95d72f1b7 — Filesystem access.
pkgs/python/[email protected]/tools/check_sum.py:41 
        dst.write_text(src_hash)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #da39951f05ce962e — Filesystem access.
pkgs/python/[email protected]/tools/cleanup_changes.py:30 
    changes = (root / "CHANGES.rst").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #de5ffa1e8748732e — Filesystem access.
pkgs/python/[email protected]/tools/gen.py:16 
    code = compile(hdrs_file.read_text(), str(hdrs_file), "exec")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

alembic

python dependency
expand_more 30 low-confidence finding(s)
low env_fs dependency Excluded from app score #1b84c5dcebe17176 — Filesystem access.
pkgs/python/[email protected]/alembic/command.py:141 
                with open(toml_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c42026f972e3185 — Filesystem access.
pkgs/python/[email protected]/alembic/command.py:174 
                with open(path, "w"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #720414a81d350081 — Filesystem access.
pkgs/python/[email protected]/alembic/config.py:277 
            with open(self._toml_file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1797d70a5ed27841 — Environment-variable access.
pkgs/python/[email protected]/alembic/config.py:985 
        alembic_config_env = os.environ.get("ALEMBIC_CONFIG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92351ac484f46369 — Filesystem access.
pkgs/python/[email protected]/alembic/templates/multidb/env.py:70 
        with open(file_, "w") as buffer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0893a1881a66aaf — Filesystem access.
pkgs/python/[email protected]/alembic/testing/env.py:93 
    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d139af8e2281f0e6 — Filesystem access.
pkgs/python/[email protected]/alembic/testing/env.py:113 
    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #498265157358e95a — Filesystem access.
pkgs/python/[email protected]/alembic/testing/env.py:300 
    with open(cfg.toml_file_name, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #907af1cafd5b5700 — Filesystem access.
pkgs/python/[email protected]/alembic/testing/env.py:307 
    with open(cfg.config_file_name, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb0e19c146a87e0f — Filesystem access.
pkgs/python/[email protected]/alembic/testing/env.py:332 
    with open(path, "wb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24482fe2e33fb738 — Environment-variable access.
pkgs/python/[email protected]/alembic/testing/fixtures.py:70 
        os.environ.pop("ALEMBIC_CONFIG", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fee92df041ae9ea — Environment-variable access.
pkgs/python/[email protected]/alembic/util/editor.py:33 
    env = os.environ if environ is None else environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2128135652415a5e — Filesystem access.
pkgs/python/[email protected]/alembic/util/pyfiles.py:48 
        with open(dest, "ab" if append_with_newlines else "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36bd562c0807fe0f — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:21 
SQLA_REPO = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bda710fa51e7a51 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:21 
SQLA_REPO = os.environ.get(
    "SQLA_REPO", "git+https://github.com/sqlalchemy/sqlalchemy.git"
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfbe30abdbede464 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:134 
    cmd.extend(os.environ.get("TOX_WORKERS", "-n4").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22aa665b67221f72 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:141 
            cmd.extend(os.environ.get("TOX_SQLITE", "--db=sqlite").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #844e9e23bd536c56 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:147 
                os.environ.get("TOX_POSTGRESQL", "--db=postgresql").split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09e5ad04fa1d16e5 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:153 
            cmd.extend(os.environ.get("TOX_MYSQL", "--db=mysql").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #140eea998d1b13ad — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:160 
            if "ORACLE_HOME" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e672b8f18258ff21 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:161 
                session.env["ORACLE_HOME"] = os.environ.get("ORACLE_HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #895ad4a1f984a1f0 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:162 
            if "NLS_LANG" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c81f69796233f550 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:163 
                session.env["NLS_LANG"] = os.environ.get("NLS_LANG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9910d6c1653f912 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:164 
            cmd.extend(os.environ.get("TOX_ORACLE", "--db=oracle").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f23850f3c2b98e77 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:170 
            cmd.extend(os.environ.get("TOX_MSSQL", "--db=mssql").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abb2139f5211d1c1 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:247 
    cmd.extend(os.environ.get("TOX_WORKERS", "-n4").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c1f60d6fd508cbd8 — Filesystem access.
pkgs/python/[email protected]/tools/write_pyi.py:85 
    with open(destination_path, "w") as buf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5a66266e5ca5eb67 — Filesystem access.
pkgs/python/[email protected]/tools/write_pyi.py:305 
            sys.stdout.write(f_path.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0fdd5a3b8df230bb — Filesystem access.
pkgs/python/[email protected]/tools/write_pyi.py:352 
        with open(self.path) as read_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2b5761dfa1a7e08f — Filesystem access.
pkgs/python/[email protected]/tools/write_pyi.py:392 
        with open(self.path) as read_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

anthropic

python dependency
expand_more 37 low-confidence finding(s)
low env_fs dependency Excluded from app score #156daa21a60cffaf — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:93 
            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab989556a272c834 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:97 
            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2419376341a760fa — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:101 
            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91416f4a889cc4ec — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:333 
            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0dd9ad06282a4463 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:337 
            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5339ab8809b8381a — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:341 
            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0290da0ac7249d8 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:67 
            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0df43d2f1f6e7722 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:79 
        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84c8034ec9e76597 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:109 
            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a0877f9d9c8cbe6 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:121 
        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35a3fe6155fe1b14 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_legacy_response.py:464 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cacc6a541e2a849 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_legacy_response.py:477 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af43b91af9d2cb2a — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_models.py:110 
            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ecda04ea3cb9a6b6 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_response.py:537 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cd5cb72eec7853a — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_response.py:579 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ded36add4f293c5 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_utils/_logs.py:17 
    env = os.environ.get("ANTHROPIC_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a486624c5752ba1f — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:248 
            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39bc5e19c2da9533 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:414 
            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b542bf56b5b6d8c1 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_utils/_utils.py:367 
    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3d41ed394596fdf — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/_files.py:25 
        files.append((path.relative_to(relative_to).as_posix(), path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e32cd76ecd35047 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/_files.py:42 
        files.append((path.relative_to(relative_to).as_posix(), await path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #518e4853d828ec8c — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:75 
    aws_region = os.environ.get("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ad742d6465784b6 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:170 
            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cc4340d303178ba — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:312 
            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a56bdf9ec73fd681 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:146 
        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55ad6d797d1ceecd — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:147 
        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcc40aa5f0763029 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:148 
        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a7a9a1e83f4fab5 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:323 
        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #479d2a3b121c752c — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:324 
        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9836d02e501598c — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:325 
        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #eac572ec15795c93 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:316 
        return full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d718d9b9ec270f31 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:609 
        return await full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51401b9224d73c87 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:44 
        project_id = os.environ.get("ANTHROPIC_VERTEX_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #878a5ef8892aba35 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:111 
            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0254459a9c8c93d0 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:118 
            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0e12013cc590f92 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:256 
            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d897a63a21644396 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:263 
            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

authlib

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #8a268d4241e45234 — Environment-variable access.
pkgs/python/[email protected]/authlib/common/security.py:15 
    if os.getenv("AUTHLIB_INSECURE_TRANSPORT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-ai-documentintelligence

python dependency
expand_more 212 low-confidence finding(s)
low env_fs dependency Excluded from app score #3bf7495e70a468ff — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_barcodes_async.py:65 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e29e1a81c7f0a84b — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_barcodes_async.py:66 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9e2bce1b781c09a — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_barcodes_async.py:72 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d3c25ad2292bed2 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_fonts_async.py:67 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4899311ccab33a2d — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_fonts_async.py:68 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e3845396defbf0f — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_fonts_async.py:73 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e63f663abfc8070b — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_formulas_async.py:65 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #196ad1f61eae0e82 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_formulas_async.py:66 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eeb11f69388eff24 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_formulas_async.py:72 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1adcf7628ecf46ee — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_highres_async.py:80 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c661f071a02a0761 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_highres_async.py:81 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #060ec57ab0bda0ba — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_highres_async.py:87 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4037ccdf1f8c613d — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_languages_async.py:59 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8792ec4631f2969e — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_languages_async.py:60 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69ae337536564618 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_languages_async.py:66 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f72d0f9d612a6af — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_query_fields_async.py:51 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8f4450346414fcb — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_addon_query_fields_async.py:52 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #114116000aeef4c1 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_batch_documents_async.py:53 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad33f5682f7f5310 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_batch_documents_async.py:54 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #115debab0bf59abc — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_batch_documents_async.py:55 
    result_container_sas_url = os.environ["RESULT_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94c963b39a91be77 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_batch_documents_async.py:56 
    batch_training_data_container_sas_url = os.environ["TRAINING_DATA_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5a11464edb8b1b2 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:65 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9da6a11bb5c587c — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:66 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f351b12d87cf76d — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:67 
    model_id = os.getenv("CUSTOM_BUILT_MODEL_ID", custom_model_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bb3282a5311965d — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:72 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14f0543834d03688 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:153 
    if os.getenv("DOCUMENTINTELLIGENCE_STORAGE_ADVANCED_CONTAINER_SAS_URL") and not os.getenv("CUSTOM_BUILT_MODEL_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f1ddffec14bb093 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:163 
        endpoint = os.getenv("DOCUMENTINTELLIGENCE_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1606641a6e65ace2 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:164 
        key = os.getenv("DOCUMENTINTELLIGENCE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb780456f9a8bd7c — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:169 
        blob_container_sas_url = os.getenv("DOCUMENTINTELLIGENCE_STORAGE_ADVANCED_CONTAINER_SAS_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66eea7da526a8931 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_custom_documents_async.py:170 
        blob_prefix = os.getenv("DOCUMENTINTELLIGENCE_STORAGE_PREFIX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c2ffe24e40918a9 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_documents_output_in_markdown_async.py:32 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ba9c001f18230b9 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_documents_output_in_markdown_async.py:33 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77ce17a462298dd8 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_general_documents_async.py:69 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #363a3b2af511ff48 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_general_documents_async.py:70 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5c5f40e6ddc6fac — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_general_documents_async.py:74 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d1707cea6b16524 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_identity_documents_async.py:44 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ad01f65ce3884e7 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_identity_documents_async.py:45 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef565c4ed5469cae — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_identity_documents_async.py:49 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f2539612e8cdddc — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_invoices_async.py:44 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63c3d8c16d97ae46 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_invoices_async.py:45 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9418a3540486b0c — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_invoices_async.py:49 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c7c735db4851ea8 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_invoices_from_bytes_source_async.py:44 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aca5c9df85e77ae3 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_invoices_from_bytes_source_async.py:45 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b724ffbea2061260 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_invoices_from_bytes_source_async.py:49 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba43d2a5435b2cdf — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_layout_async.py:73 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d4f22b55274a8c6 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_layout_async.py:74 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b16c52ed706e84c9 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_layout_async.py:78 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61a1ee66ca5e3ca0 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_read_async.py:69 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5a1eb7c1769d388 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_read_async.py:70 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7044830815ae46d — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_read_async.py:74 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9d2e5d725454432 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_receipts_async.py:51 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #832ed522cec16022 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_receipts_async.py:52 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c06c6a5441199b5 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_receipts_async.py:56 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17769f6fe7b66b67 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_receipts_from_url_async.py:40 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f16b3688486e7f7b — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_receipts_from_url_async.py:41 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6701da57f72aa2c — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_figures_async.py:44 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7f23d41e2695259 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_figures_async.py:45 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9515d632c27f96d7 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_figures_async.py:50 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0870de9ca8b0daf9 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_figures_async.py:65 
                    with open(f"{figure.id}_async.png", "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #528c7a6100a5dfe4 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_pdf_async.py:44 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a639ef3382042ab0 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_pdf_async.py:45 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a667cf9c4412f2f0 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_pdf_async.py:50 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f142b9a896352416 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_result_pdf_async.py:62 
        with open("async_analyze_result.pdf", "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6460e57c270dbe1b — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_tax_us_w2_async.py:48 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d78ca034e9817b0 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_tax_us_w2_async.py:49 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71ac674e9d173748 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_analyze_tax_us_w2_async.py:53 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c96d65bf5e93f020 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:49 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #adca3cedbbab222c — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:50 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be8c2e439302cd79 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:51 
    classifier_id = os.getenv("CLASSIFIER_ID", classifier_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f2ba71c7da298cf — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:55 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3301e70aa618bdc3 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:71 
    if os.getenv("DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL") and not os.getenv("CUSTOM_BUILT_MODEL_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4659301980800dd1 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:81 
        endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2ca2af6858f6df1 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:82 
        key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7f7c688403d71c5 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_classify_document_async.py:83 
        blob_container_sas_url = os.environ["DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c463a63967d9398 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_compose_model_async.py:55 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1d4fc0da4779991 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_compose_model_async.py:56 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fe84c508d001a3d — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_compose_model_async.py:57 
    container_sas_url = os.environ["DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71a2875f1ebf3dc6 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_compose_model_async.py:138 
    if os.getenv("DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL") and not os.getenv("CUSTOM_BUILT_MODEL_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62416e2c832ca9ee — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_compose_model_async.py:148 
        endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e7b5b8d14a6cc6d — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_compose_model_async.py:149 
        key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf5295e24c45ffd3 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_compose_model_async.py:150 
        blob_container_sas_url = os.environ["DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59756b2b7b96b6b5 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_convert_to_and_from_dict_async.py:44 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd220429b22affa1 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_convert_to_and_from_dict_async.py:45 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a0fe1fa9dbe0879 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_convert_to_and_from_dict_async.py:49 
        with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9af055c46ce8b7e4 — Filesystem access.
pkgs/python/[email protected]/samples/async_samples/sample_convert_to_and_from_dict_async.py:57 
    with open("data.json", "w") as output_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #740a6cd6fe593591 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:40 
    source_endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11a08671a609690e — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:41 
    source_key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac3788601a1806ae — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:42 
    target_endpoint = os.environ["DOCUMENTINTELLIGENCE_TARGET_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #781334bcd79050e2 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:43 
    target_key = os.environ["DOCUMENTINTELLIGENCE_TARGET_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac1e7b471240d3a0 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:44 
    source_model_id = os.getenv("AZURE_SOURCE_MODEL_ID", custom_model_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f12f4b2c2c4442d — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:90 
    if os.getenv("DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL") and not os.getenv("CUSTOM_BUILT_MODEL_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cd1a091025e679e — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:100 
        endpoint = os.getenv("DOCUMENTINTELLIGENCE_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b731dc7493589fea — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:101 
        key = os.getenv("DOCUMENTINTELLIGENCE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42eeed0fa7e737aa — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_copy_model_to_async.py:106 
        blob_container_sas_url = os.getenv("DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4dc192f66b7977fa — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_get_raw_response_async.py:30 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47f743ee397e4d83 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_get_raw_response_async.py:31 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f52b00fd0b88bce — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_manage_classifiers_async.py:40 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9712755f2af38e95 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_manage_classifiers_async.py:41 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a1a542a7eb57d3c — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_manage_classifiers_async.py:42 
    container_sas_url = os.environ["DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f2bb16d9a3adbfe — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_manage_models_async.py:41 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af13c20fb1730337 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_manage_models_async.py:42 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df954bba3c71e275 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_manage_models_async.py:43 
    container_sas_url = os.environ["DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a946b4acdb9b338 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_send_request_async.py:31 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59488e0590422e77 — Environment-variable access.
pkgs/python/[email protected]/samples/async_samples/sample_send_request_async.py:32 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b0c9c4e0089d0be — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_barcodes.py:58 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50b5ca0349756c6f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_barcodes.py:59 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffd41345607d4c75 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_addon_barcodes.py:64 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3ca8023e9484362 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_fonts.py:65 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74ea9d98018e8b61 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_fonts.py:66 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3514e7b4face77a — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_addon_fonts.py:70 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1410f66616a9652 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_formulas.py:63 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c426a8e62ef67de7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_formulas.py:64 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10af3e6db0d5a834 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_addon_formulas.py:69 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f01cabdac64bc137 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_highres.py:69 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #347051cfce78ef8c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_highres.py:70 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e2094234029a8d4 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_addon_highres.py:75 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #007ce898f2f9bfc5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_languages.py:58 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #060ff2f0f390f185 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_languages.py:59 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef09ed28a0022c3c — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_addon_languages.py:64 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7560d1d34ebb4c23 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_query_fields.py:51 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca65076140fb7325 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_addon_query_fields.py:52 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02d9215e97cc5393 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_batch_documents.py:52 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6753395d54af249 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_batch_documents.py:53 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a784c972de7f82a7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_batch_documents.py:54 
    result_container_sas_url = os.environ["RESULT_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f1e8b1dc26f75e2 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_batch_documents.py:55 
    batch_training_data_container_sas_url = os.environ["TRAINING_DATA_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #268e0bc0729ec0cf — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:64 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2962ea9fc75bb20b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:65 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b25835b82bc53c4 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:66 
    model_id = os.getenv("CUSTOM_BUILT_MODEL_ID", custom_model_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79fb0ff36dd977be — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:71 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc73d6bc8c6a4124 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:162 
        if os.getenv("DOCUMENTINTELLIGENCE_STORAGE_ADVANCED_CONTAINER_SAS_URL") and not os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f11ff2f7e5603439 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:162 
        if os.getenv("DOCUMENTINTELLIGENCE_STORAGE_ADVANCED_CONTAINER_SAS_URL") and not os.getenv(
            "CUSTOM_BUILT_MODEL_ID"
        ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22fa19d1ce2ed7c6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:174 
            endpoint = os.getenv("DOCUMENTINTELLIGENCE_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e13962beb63a556 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:175 
            key = os.getenv("DOCUMENTINTELLIGENCE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25963b3590dd6ced — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:183 
            blob_container_sas_url = os.getenv("DOCUMENTINTELLIGENCE_STORAGE_ADVANCED_CONTAINER_SAS_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12b87284950da932 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_custom_documents.py:184 
            blob_prefix = os.getenv("DOCUMENTINTELLIGENCE_STORAGE_PREFIX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d7baefca48c3649 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_documents_output_in_markdown.py:32 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #138421747f6f9aba — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_documents_output_in_markdown.py:33 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1f6e42e0b070d0d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_general_documents.py:59 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df73d76e60a8a89b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_general_documents.py:60 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd70f644c3445550 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_general_documents.py:63 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8ba3feb9cf470f6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_identity_documents.py:42 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5e3d480d9006203 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_identity_documents.py:43 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d73d68f61f30922a — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_identity_documents.py:46 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd2ae5f724127955 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_invoices.py:43 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02d3fbefd690c481 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_invoices.py:44 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3011d764cac648fd — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_invoices.py:47 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fa8edfdfad8acd2 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_invoices_from_bytes_source.py:42 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a02d2b4a8b9943ea — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_invoices_from_bytes_source.py:43 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #302f82b75978ac92 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_invoices_from_bytes_source.py:46 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d068a2b317355c5c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_layout.py:56 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f98979fed4cb871 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_layout.py:57 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edb80b074a81daf2 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_layout.py:60 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b283657f541a9efd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_read.py:67 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3adb287f3a3cda27 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_read.py:68 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdc2c36548e48f69 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_read.py:71 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ef6f019b15ed23c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_receipts.py:49 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1055f3ff1bd6b89c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_receipts.py:50 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99a12bd5d746b93a — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_receipts.py:53 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f298a2f41d2baaba — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_receipts_from_url.py:40 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e7ec1fa4d88966d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_receipts_from_url.py:41 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85c7f96dfe05ae71 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_result_figures.py:43 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8097c5a5108c72e3 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_result_figures.py:44 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cb50a04527c81dd — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_result_figures.py:48 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e043c7fa546c6501 — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_result_figures.py:63 
                with open(f"{figure.id}.png", "wb") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2dc1e8ff572c22c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_result_pdf.py:43 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2d307e564e58a9f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_result_pdf.py:44 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3eb136b3b45effa — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_result_pdf.py:48 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8109b15d9613febc — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_result_pdf.py:58 
    with open("analyze_result.pdf", "wb") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #155af0a97714a125 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_tax_us_w2.py:46 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7891d5c6fa2ddde — Environment-variable access.
pkgs/python/[email protected]/samples/sample_analyze_tax_us_w2.py:47 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #076ea1650daa99cc — Filesystem access.
pkgs/python/[email protected]/samples/sample_analyze_tax_us_w2.py:50 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #555487d2b3acc1e1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_classify_document.py:48 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #013ed9d2baa1012e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_classify_document.py:49 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38eea106712c57f1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_classify_document.py:50 
    classifier_id = os.getenv("CLASSIFIER_ID", classifier_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41c487c5b462585a — Filesystem access.
pkgs/python/[email protected]/samples/sample_classify_document.py:53 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5e66c8d6bb01092 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_classify_document.py:76 
        if os.getenv("DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL") and not os.getenv("CLASSIFIER_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7402cf22961dfd48 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_classify_document.py:85 
            endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #256f677214332505 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_classify_document.py:86 
            key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #704ec0c6081d0d50 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_classify_document.py:87 
            blob_container_sas_url = os.environ["DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35243672f40d4f85 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:55 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef5f5d38d9332cfe — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:56 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1f21088b54f2a9a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:57 
    container_sas_url = os.environ["DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99e6108f80ae1edc — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:58 
    classifier_id = os.getenv("CLASSIFIER_ID", classifier_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b52f3084c9780c6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:145 
        if os.getenv("DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL") and not os.getenv("CLASSIFIER_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d08320ac14cd66b1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:154 
            endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a9bc66c09c31e78 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:155 
            key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39b6aab800af41b8 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_compose_model.py:156 
            blob_container_sas_url = os.environ["DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ce9097630fe340e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_convert_to_and_from_dict.py:43 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6f83d6474cebc47 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_convert_to_and_from_dict.py:44 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d064a80056da61d7 — Filesystem access.
pkgs/python/[email protected]/samples/sample_convert_to_and_from_dict.py:47 
    with open(path_to_sample_documents, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a80989a7d60a4ccf — Filesystem access.
pkgs/python/[email protected]/samples/sample_convert_to_and_from_dict.py:55 
    with open("data.json", "w") as output_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9989dfdcf296097e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:40 
    source_endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47510230f643d820 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:41 
    source_key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #865a799fa65bdab7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:42 
    target_endpoint = os.environ["DOCUMENTINTELLIGENCE_TARGET_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #baf584b49c8aa911 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:43 
    target_key = os.environ["DOCUMENTINTELLIGENCE_TARGET_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09f71aa69694e5b0 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:44 
    source_model_id = os.getenv("AZURE_SOURCE_MODEL_ID", custom_model_id)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #196eaf8a760d45e9 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:94 
        if os.getenv("DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL") and not os.getenv("AZURE_SOURCE_MODEL_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04c021c004999363 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:104 
            endpoint = os.getenv("DOCUMENTINTELLIGENCE_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d69d7113ef1e356b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:105 
            key = os.getenv("DOCUMENTINTELLIGENCE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52249eb71b2a8be1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_copy_model_to.py:113 
            blob_container_sas_url = os.getenv("DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6161c6b1acd8895d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_get_raw_response.py:30 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3817f3209e5011e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_get_raw_response.py:31 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88afa7f71fe9f441 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_manage_classifiers.py:40 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccf6083d6ab32825 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_manage_classifiers.py:41 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #071338a401f57a8a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_manage_classifiers.py:42 
    container_sas_url = os.environ["DOCUMENTINTELLIGENCE_TRAINING_DATA_CLASSIFIER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28149fa1e85094cb — Environment-variable access.
pkgs/python/[email protected]/samples/sample_manage_models.py:41 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3f5fb0d7d129876 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_manage_models.py:42 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76b30b933ebe3dff — Environment-variable access.
pkgs/python/[email protected]/samples/sample_manage_models.py:43 
    container_sas_url = os.environ["DOCUMENTINTELLIGENCE_STORAGE_CONTAINER_SAS_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ed8724d28edc384 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_send_request.py:31 
    endpoint = os.environ["DOCUMENTINTELLIGENCE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef748da514fd0eac — Environment-variable access.
pkgs/python/[email protected]/samples/sample_send_request.py:32 
    key = os.environ["DOCUMENTINTELLIGENCE_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1c86e35cb7d65d0 — Filesystem access.
pkgs/python/[email protected]/setup.py:22 
with open(os.path.join(package_folder_path, "_version.py"), "r") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dea0fa8128b24a15 — Filesystem access.
pkgs/python/[email protected]/setup.py:33 
    long_description=open("README.md", "r").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-identity

python dependency
expand_more 105 low-confidence finding(s)
low env_fs dependency Excluded from app score #1c330906214d7e24 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/app_service.py:22 
    url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3394bd4d7489806a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/app_service.py:23 
    secret = os.environ.get(EnvironmentVariables.IDENTITY_HEADER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81be06552a04015d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azd_cli.py:239 
        path = os.environ.get("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b0d795f73d6e948 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azd_cli.py:322 
            "env": dict(os.environ, NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a30797b438180d57 — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_arc.py:52 
    with open(key_file, "r", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6645aa1fa2181576 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_arc.py:74 
        program_data_path = os.environ.get("PROGRAMDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9efeba18cf901b83 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_cli.py:240 
        path = os.environ.get("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7567ffb153e7d3a3 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_cli.py:278 
            "env": dict(os.environ, AZURE_CORE_NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5edaee81a705c3ed — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_ml.py:23 
    url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59b797ad732ea56d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_ml.py:24 
    secret = os.environ.get(EnvironmentVariables.MSI_SECRET)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e75161e1e94991b — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_pipelines.py:25 
    base_uri = os.environ[SYSTEM_OIDCREQUESTURI].rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1661afbc4b574401 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_pipelines.py:37 
    if SYSTEM_OIDCREQUESTURI not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58b22220eb934c83 — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/certificate.py:149 
        with open(certificate_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7165e41415f26f4a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/cloud_shell.py:34 
        url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d0902a614281473 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:154 
            "interactive_browser_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #607328111a43d17c — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:158 
            "managed_identity_client_id", os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0141076284dfd319 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:162 
            "workload_identity_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6067f3c76700f2b2 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:166 
        broker_tenant_id = kwargs.pop("broker_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac296798a20d3a13 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:169 
        shared_cache_username = kwargs.pop("shared_cache_username", os.environ.get(EnvironmentVariables.AZURE_USERNAME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f88bad15b01b3dd — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:171 
            "shared_cache_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f8901b635ae06f8 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:176 
        token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2538e5e02e2323c1 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:268 
                        token_file_path=os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be2875114ea194e8 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:63 
        if all(os.environ.get(v) is not None for v in EnvironmentVariables.CLIENT_SECRET_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ea6daaa7de5f32d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:65 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b2e1eeb93fe379a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:66 
                client_secret=os.environ[EnvironmentVariables.AZURE_CLIENT_SECRET],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad410caacaae7d94 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:67 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5279ffa046875d9 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:70 
        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.CERT_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f0ccadf15e848f9 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:72 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2be35c23d3c97436 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:73 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78ebf40247967e54 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:74 
                certificate_path=os.environ[EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PATH],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #578cac95827755fc — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:75 
                password=os.environ.get(EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PASSWORD),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a29347b984488e87 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:77 
                    os.environ.get(EnvironmentVariables.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d3beefcfc15a628 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:81 
        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.USERNAME_PASSWORD_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6f8345e6f78c812 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:83 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47a094ef53e1752d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:84 
                username=os.environ[EnvironmentVariables.AZURE_USERNAME],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f593fb12f753b34 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:85 
                password=os.environ[EnvironmentVariables.AZURE_PASSWORD],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29ba6b82c43dfe26 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:86 
                tenant_id=os.environ.get(EnvironmentVariables.AZURE_TENANT_ID),  # optional for username/password auth

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d8bdb421e98adec — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:106 
            set_variables = [v for v in expected_variables if v in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d3fe5d194347140 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/imds.py:60 
        os.environ.get(EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST, IMDS_AUTHORITY).strip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad52b861725d9ed7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/imds.py:90 
        if EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f0a561e5c0eb1da — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:82 
        if os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa6fefa64cdf7ae7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:83 
            if os.environ.get(EnvironmentVariables.IDENTITY_HEADER):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b35c399c62486cff — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:84 
                if os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #321a91f5e3d43eaf — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:98 
            elif os.environ.get(EnvironmentVariables.IMDS_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #128ef88f59ee3323 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:103 
        elif os.environ.get(EnvironmentVariables.MSI_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33b311b93d79c21a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:104 
            if os.environ.get(EnvironmentVariables.MSI_SECRET):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af82260079d85fcf — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:115 
            all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9353b2d592257e5 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:120 
            workload_client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6c0c41c5c322adc — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:131 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8306bedf9c2ff6f4 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:133 
                token_file_path=os.environ[EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #991e916cf5227de8 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:42 
    url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #761e39bc13740016 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:43 
    secret = os.environ.get(EnvironmentVariables.IDENTITY_HEADER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79c96f4f94b0bf28 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:44 
    thumbprint = os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a857fb8381adf01 — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/vscode.py:50 
            with open(expanded_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1b95c47a897a0c0 — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:33 
            with open(self._token_file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7694d00835ebda64 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:79 
        tenant_id = tenant_id or os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6913681c5f21687 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:80 
        client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec5306dac80c2232 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:81 
        token_file_path = token_file_path or os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06b57b4e7ea7f72b — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/msal_credentials.py:39 
        self._regional_authority = os.environ.get(EnvironmentVariables.AZURE_REGIONAL_AUTHORITY_NAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6020095d9cf083fe — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/utils.py:90 
    authority = os.environ.get(EnvironmentVariables.AZURE_AUTHORITY_HOST, KnownAuthorities.AZURE_PUBLIC_CLOUD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bff87e5cee10d68d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/utils.py:151 
    if default_tenant == "adfs" or os.environ.get(EnvironmentVariables.AZURE_IDENTITY_DISABLE_MULTITENANTAUTH):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b59f65bb0df1fef — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/utils.py:207 
    token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #409933ed7b84d4ff — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_persistent_cache.py:88 
    if sys.platform.startswith("win") and "LOCALAPPDATA" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #972abe51a96f5dd9 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_persistent_cache.py:89 
        cache_location = os.path.join(os.environ["LOCALAPPDATA"], ".IdentityService", cache_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e5b19e58c063125 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azd_cli.py:221 
            env=dict(os.environ, NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #00da56bcccfc72ae — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_arc.py:19 
        url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad4a5b52c89d100a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_arc.py:20 
        imds = os.environ.get(EnvironmentVariables.IMDS_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e037b9c05cb5014a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_cli.py:226 
            env=dict(os.environ, AZURE_CORE_NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3ec928735645c3e — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/cloud_shell.py:21 
        url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d5d1ea8cf2d30fe — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:135 
        shared_cache_username = kwargs.pop("shared_cache_username", os.environ.get(EnvironmentVariables.AZURE_USERNAME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4fd0e32c4579918 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:137 
            "shared_cache_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98a62830fab52247 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:141 
            "managed_identity_client_id", os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a34e583c56da63a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:145 
            "workload_identity_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1dd2a0a3ebe22ae — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:150 
        token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0020172d7000da2e — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:231 
                        token_file_path=os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f11a8204e5deceaa — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:57 
        if all(os.environ.get(v) is not None for v in EnvironmentVariables.CLIENT_SECRET_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f9a5a8b31489702 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:59 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a7ddcd6f70132c5 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:60 
                client_secret=os.environ[EnvironmentVariables.AZURE_CLIENT_SECRET],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c176a66bdfb589c9 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:61 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #000cee7da1c3a158 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:64 
        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.CERT_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9291148a3d4bfd68 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:66 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3630b4b536bcd3a7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:67 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc10e54967767e1b — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:68 
                certificate_path=os.environ[EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PATH],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0feeac40b5e7160 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:69 
                password=os.environ.get(EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PASSWORD),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a814e0475df90b4 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:71 
                    os.environ.get(EnvironmentVariables.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6870fdf0bad03a7e — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:80 
            set_variables = [v for v in expected_variables if v in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca96bc71c519473f — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/imds.py:54 
        if EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e431e2f32926cb75 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:54 
        if os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1596873a30490440 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:55 
            if os.environ.get(EnvironmentVariables.IDENTITY_HEADER):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66ddee26ab272c90 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:56 
                if os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58a677e9d40d6d78 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:70 
            elif os.environ.get(EnvironmentVariables.IMDS_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #042f32c2f7c538fd — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:75 
        elif os.environ.get(EnvironmentVariables.MSI_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f06e9b070f611550 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:76 
            if os.environ.get(EnvironmentVariables.MSI_SECRET):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #584eae670934796d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:87 
            all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #963bcf056bfd2a99 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:92 
            workload_client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38b9602b6cf55ab3 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:103 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0756d5b21f851145 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:105 
                token_file_path=os.environ[EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef2c42cdd3c643f2 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:57 
        tenant_id = tenant_id or os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8df2dff0c77524ee — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:58 
        client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32bba0e071b5a9fc — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:59 
        token_file_path = token_file_path or os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84cd9caa9ffd0f07 — Environment-variable access.
pkgs/python/[email protected]/samples/control_interactive_prompts.py:17 
VAULT_URL = os.environ.get("VAULT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6740fae3dd5a4522 — Environment-variable access.
pkgs/python/[email protected]/samples/credential_creation_code_snippets.py:360 
        system_access_token=os.environ["SYSTEM_ACCESSTOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a186462226566268 — Environment-variable access.
pkgs/python/[email protected]/samples/credential_creation_code_snippets.py:374 
        system_access_token=os.environ["SYSTEM_ACCESSTOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd09164138e593bb — Environment-variable access.
pkgs/python/[email protected]/samples/key_vault_cert.py:19 
VAULT_URL = os.environ["VAULT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5783c60b8ce5576 — Environment-variable access.
pkgs/python/[email protected]/samples/user_authentication.py:14 
VAULT_URL = os.environ.get("VAULT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-search-documents

python dependency
expand_more 133 low-confidence finding(s)
low env_fs dependency Excluded from app score #e6a8cc71396f1a7f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:43 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9dbbe0a2e2b9b70a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:44 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #817ce57661a5df58 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3353dcd45b7572d2 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:44 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2563a038e8b9a876 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:45 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8552345f2d33553a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d796b77f1e2d740 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:30 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5f09f1437d250f7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:31 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #746bb790fb3fd1b1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:32 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c33c5bb9830bc70 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:47 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f95990ab6b29eda — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:48 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f86a13b6e14f88f8 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:63 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #396d8f9aeda3aa85 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:64 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2e0df40da70a0c0 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:80 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #239168aede2c97cb — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:31 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01186af84c506a2e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:32 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42f0bee5294b1dae — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:33 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #237face6fa2f0b5f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:49 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ae48377e037eee7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:50 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4050c6ff67ebf05 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:66 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ef71bc432aacea4 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:67 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #472a62c25c20ff5f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:84 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #996b59b0c451175c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af905d21141c6f24 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12171a522064ee85 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7d8a0d9de946608 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e985382defb405a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab6cded7d76317b6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b18b352fd9da699c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbad9e02b1b5fc21 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de3743c0a63209ad — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05b07e6e586006b1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf2cfcaa6917c6f5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #623561c3d1e3e3fc — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ff32cee382ded43 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84435e446728d57f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f76236ad8f16b8cd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #993912df2e22fc00 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #199a9c07332e6efc — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #00dd188b891ec21f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f1d01721b33fbdd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #210696c0d98da801 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67ac20722d0b935a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fe4299277359565 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02218b46de571baa — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c061d86df40d71b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0599a25c30a99a2d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:31 
    endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9062cb12c674aa12 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:32 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e4c447417aad314 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:33 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #618240e59c50bfc7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:35 
    endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc3707fcc2722497 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:36 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55b96bf44c025d2d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:37 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9274aef06ae3fd2d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be05353e6ab4423f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #750b1c6a76eb7a37 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a666b3edd78e83f1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b17a5c1c18cfa07 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5653cb41a6b2e00 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #645da5d4c1611c1c — Filesystem access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:54 
    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dba364509e2300c4 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #841ff6b232bee6cf — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d93a54a121a5e400 — Filesystem access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:56 
    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #110cb4d7da3ba5de — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9393d3f2f800e8e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a1344c911b2334d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:26 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae1e2d01cdc8a1b5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d4257cf457abf0e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc331260656b64fd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:27 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23c21113ba40442e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dd2ce9bfbddae3c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc0f729bc91547ac — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:26 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #429056b71f9a0e04 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #743cdf5715bbb149 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0ba4029b28be2a4 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:27 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd3947514f873904 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2bc5cb7c8bb898b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5db326fb8d44249 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:26 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0abf64a242853b92 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04e97839cc5a0348 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1445974cfbbaab1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9346425ded1abfd1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1af08ab9dc129cb — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #185b6b53efd01466 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37a0029941f21de9 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b248609bc34004c6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #092ea2e8c2002137 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee04d1d4b767b20a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d11c07a26ca0d11d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b46ba4022a8b078 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fef085c9d245960 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e36b2aa7cda8d6e2 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96a2819cbe0954ab — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #658060babc5dcf00 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5fa0778a1446853 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9870e2d70d8e5721 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b109d47945965591 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1038820fedafea81 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f3522fb7d1fa26d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42ac1d820f0b63ac — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8ac15744ba0ec56 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:24 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d181d6560409276e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c3a96bd9768b998 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #057df7d302738e74 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65157f177210693e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a01bd2d55881c7f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session_async.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfc77dcfc0711656 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session_async.py:24 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7d4e6d0ba40d422 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session_async.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5d0d8a4d71b4c48 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de9db278a0d04827 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b503c0b183da1a3 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75222e421c47e468 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4889bb2c8b07733a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a96064b52d0677f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ecc25aebe1553cf — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29f0ade2bb910fd0 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #779fabda2cdfd537 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9633c18b11e3c351 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae8b7d1c436fe716 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e4e9e2d2e701290 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e1897a35540cbe5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector.py:49 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d7d592508df3420 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e071db0aa3f6ab9 — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector.py:60 
    with open(query_vector_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6db8a8e4a37f1c9 — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector.py:134 
    with open(documents_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8135fce71b5e21e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:51 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9b4c1bfe3707787 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b146e0c763ff934 — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:63 
    with open(query_vector_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d892d8bec1b44c4c — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:138 
    with open(documents_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15d0afa9b7822ef9 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69fe18088f7b9ae5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:24 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce837f6e3cf98157 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8d87a090411579c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60b13ee23651ac2c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27541ad9c358532b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-storage-blob

python dependency
expand_more 60 low-confidence finding(s)
low env_fs dependency Excluded from app score #1a9a5820d592d018 — Filesystem access.
pkgs/python/[email protected]/azure/storage/blob/__init__.py:203 
            with open(output, 'wb') as file_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16ac6296afb2968c — Filesystem access.
pkgs/python/[email protected]/azure/storage/blob/_shared/avro/avro_io.py:161 
        input_bytes = self.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56ffcc50cb8eede5 — Filesystem access.
pkgs/python/[email protected]/azure/storage/blob/_shared/avro/avro_io.py:242 
            result = decoder.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca7044d86f3aaa98 — Filesystem access.
pkgs/python/[email protected]/azure/storage/blob/_shared/avro/avro_io_async.py:143 
        input_bytes = await self.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #709c5562291e30a6 — Filesystem access.
pkgs/python/[email protected]/azure/storage/blob/_shared/avro/avro_io_async.py:225 
            result = await decoder.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f0c80c0dc0423fc — Filesystem access.
pkgs/python/[email protected]/azure/storage/blob/_shared/avro/datafile.py:209 
            data = self.raw_decoder.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9dbe63031cabcec1 — Filesystem access.
pkgs/python/[email protected]/azure/storage/blob/aio/__init__.py:149 
            with open(output, 'wb') as file_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a50b32675a07997e — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication.py:30 
        os.getenv("STORAGE_ACCOUNT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3a050997ca455be — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication.py:33 
        os.getenv("OAUTH_STORAGE_ACCOUNT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43fbfd4cad4432ac — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication.py:36 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0610361d1014ce6f — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication.py:37 
    shared_access_key = os.getenv("STORAGE_ACCOUNT_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8454871e9c60015 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication_async.py:32 
        os.getenv("STORAGE_ACCOUNT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd37dabf230ee820 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication_async.py:35 
        os.getenv("OAUTH_STORAGE_ACCOUNT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f587b5a08f2ee1f8 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication_async.py:38 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed29a291c31c2821 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_authentication_async.py:39 
    shared_access_key = os.getenv("STORAGE_ACCOUNT_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4be30cd9f4231b75 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_batch_delete_blobs.py:22 
    connection_string = os.getenv('STORAGE_CONNECTION_STRING')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e5046fe36c32532 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_batch_delete_blobs.py:38 
        with open(local_path+filename, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c28778a560c401e — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_client_side_encryption.py:278 
    CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfd4fdcd8090edbc — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_client_side_encryption_keyvault.py:44 
        return os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4938c64cd2a8e12 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_common.py:32 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING_SOFT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e2779a94b6a5ec6 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_common.py:56 
        with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b2db75b391b0a64 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_common.py:104 
        with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12ca95a43984d6ff — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_common.py:179 
        with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e88ca1583a84cc93 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_common_async.py:31 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING_SOFT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f8cc6d160be10d2 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_common_async.py:55 
            with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99e45395b7130d29 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_common_async.py:103 
            with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfce60bb008d9683 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_common_async.py:179 
            with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a973bf13a69e3eba — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_container_access_policy.py:39 
    CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc66ea6ef18ee504 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_container_access_policy_async.py:40 
    CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2e53123c89a9222 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_containers.py:32 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1aec212492ff218e — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_containers.py:210 
        with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fa1de2dc4668388 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_containers_async.py:29 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da0f83d89a82ae3c — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_containers_async.py:209 
            with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95a82ac6b90861c2 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_copy_blob.py:25 
        CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8623f817aa019b59 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_copy_blob_async.py:26 
        CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7587959ec2fe5dc3 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_enumerate_blobs.py:24 
        CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da4d555aef886f00 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_enumerate_blobs_async.py:25 
        CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82f963008facf6c5 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_hello_world.py:31 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #402b0068afda0f4e — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world.py:80 
            with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #230f5ab800e09e69 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world.py:85 
            with open(DEST_FILE, "wb") as my_blob:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67c1ba46be9e4ebc — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world.py:172 
            with open(DEST_FILE, "wb") as my_blob:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ceed7921dfb91fa8 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world.py:204 
            with open(SOURCE_FILE, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44e224b324d814e7 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world.py:208 
            with open(DEST_FILE, "wb") as my_blob:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #692a8fae73b6c9f7 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_hello_world_async.py:31 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fa7c205d8f84ce9 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world_async.py:84 
                with open(SOURCE_FILE, "rb") as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5e668ec39e5ab82 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world_async.py:89 
                with open(DEST_FILE, "wb") as my_blob:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90ba67411e940863 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world_async.py:180 
                with open(DEST_FILE, "wb") as my_blob:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2e10dbf7b4f19a9 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world_async.py:214 
                with open(SOURCE_FILE, "rb") as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #630535106e31a979 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_hello_world_async.py:218 
                with open(DEST_FILE, "wb") as my_blob:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b32854f1b66338f4 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_network_activity_logging.py:39 
connection_string = os.environ.get('STORAGE_CONNECTION_STRING', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c286e9d61ddd5ee — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_proxy_configuration.py:32 
connection_string = os.environ.get('AZURE_STORAGE_CONNECTION_STRING', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #203fd7ae6712a8be — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_proxy_configuration.py:59 
os.environ[HTTPS_PROXY_ENV_VAR] = https_proxy

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23738f744de9d901 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_query.py:26 
        CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a03fa8799897868 — Filesystem access.
pkgs/python/[email protected]/samples/blob_samples_query.py:46 
    with open(BASE_FILE, "rb") as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd1bf9d66854dadf — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_service.py:23 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a63a3a69c4464ca — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_service_async.py:25 
    connection_string = os.getenv("STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58cc65827a1d7761 — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_walk_blob_hierarchy.py:49 
    CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7cc27b9173df3ef — Environment-variable access.
pkgs/python/[email protected]/samples/blob_samples_walk_blob_hierarchy_async.py:48 
    CONNECTION_STRING = os.environ['STORAGE_CONNECTION_STRING']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7091f285f2b0f644 — Filesystem access.
pkgs/python/[email protected]/setup.py:39 
with open(os.path.join(package_folder_path, '_version.py'), 'r') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55f805e0d1f678e0 — Filesystem access.
pkgs/python/[email protected]/setup.py:51 
    long_description=open('README.md', 'r').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

boto3

python dependency
expand_more 4 low-confidence finding(s)
low env_fs tooling reachable #0c526f5f350ab6a3 — Filesystem access.
pkgs/python/[email protected]/boto3/docs/__init__.py:50 
        with open(service_doc_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #4032d521f2aa36f6 — Filesystem access.
pkgs/python/[email protected]/boto3/docs/service.py:200 
            with open(examples_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9285cef354d6fb44 — Filesystem access.
pkgs/python/[email protected]/setup.py:24 
    init = open(os.path.join(ROOT, 'boto3', '__init__.py')).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #853979d907491e81 — Filesystem access.
pkgs/python/[email protected]/setup.py:32 
    long_description=open('README.rst').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

brotlicffi

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #555a7ad5c1f5eccf — Filesystem access.
pkgs/python/[email protected]/setup.py:12 
    open("README.rst").read() + '\n\n' + open("HISTORY.rst").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc166ab00cea2047 — Filesystem access.
pkgs/python/[email protected]/setup.py:15 
with open(os.path.join(base_dir, "src", "brotlicffi", "__init__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2abf2f263ad2e08a — Environment-variable access.
pkgs/python/[email protected]/setup.py:43 
USE_SHARED_BROTLI = os.environ.get("USE_SHARED_BROTLI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fea6c129ea3652dd — Environment-variable access.
pkgs/python/[email protected]/src/brotlicffi/_build.py:8 
USE_SHARED_BROTLI = os.environ.get("USE_SHARED_BROTLI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

chardet

python dependency
expand_more 38 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #eec5b52f3725d95d — Filesystem access.
pkgs/python/[email protected]/scripts/benchmark_char_dataset.py:132 
        data = filepath.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ea9a8b9f7cbb3544 — Filesystem access.
pkgs/python/[email protected]/scripts/benchmark_char_dataset.py:208 
        tmp.write_text(
            "import charset_normalizer; print(charset_normalizer.__version__)"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d03788a395cbbf31 — Filesystem access.
pkgs/python/[email protected]/scripts/benchmark_char_dataset.py:243 
        script.write_text(_CN_DETECT_SCRIPT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1e4f61186e72dfdc — Filesystem access.
pkgs/python/[email protected]/scripts/benchmark_char_dataset.py:324 
        data_bytes = filepath.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7a2eaed73c8bd208 — Filesystem access.
pkgs/python/[email protected]/scripts/benchmark_char_dataset.py:413 
    return hashlib.sha256(filepath.read_bytes()).hexdigest()[:12]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3f5e246dd19205fc — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:95 
                cn_hashes.add(_norm_hash(f.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e840313503d41c55 — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:101 
        if _norm_hash(fp.read_bytes()) in cn_hashes

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ec5dc9c3fa60338f — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:139 
        h.update(p.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ad0e461c90fff5d4 — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:223 
        tmp.write_text(script)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #148fcfcf720d0fe8 — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:249 
        tmp.write_text(script)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #68233ff5d208c0c8 — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:282 
        tmp.write_text(script)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #af8dbe8f74bdd8a8 — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:317 
            tmp.write_text("import chardet; print(chardet.__version__)")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #09fc84a3529dfe14 — Environment-variable access.
pkgs/python/[email protected]/scripts/compare_detectors.py:375 
        if os.environ.get("HATCH_BUILD_HOOK_ENABLE_MYPYC", "").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d7822f0e3583620f — Filesystem access.
pkgs/python/[email protected]/scripts/compare_detectors.py:719 
        and is_equivalent_detection(filepath.read_bytes(), expected_encoding, detected)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #77d58070e2a66ac9 — Environment-variable access.
pkgs/python/[email protected]/scripts/compare_detectors.py:1313 
            k: v for k, v in os.environ.items() if k != "HATCH_BUILD_HOOK_ENABLE_MYPYC"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #973d61cc23aca6a1 — Environment-variable access.
pkgs/python/[email protected]/scripts/compare_detectors.py:1334 
            env={**os.environ, "HATCH_BUILD_HOOK_ENABLE_MYPYC": "true"},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #74777bc9621aeb86 — Filesystem access.
pkgs/python/[email protected]/scripts/confusion_training.py:209 
    data = input_path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fbe0de5c01b112c9 — Filesystem access.
pkgs/python/[email protected]/scripts/data_sources.py:154 
        texts.append(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #54869a3583207009 — Filesystem access.
pkgs/python/[email protected]/scripts/data_sources.py:161 
    (cache_dir / f"{index:06d}.txt").write_text(text, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5b149f4657742829 — Filesystem access.
pkgs/python/[email protected]/scripts/data_sources.py:176 
    (cache_dir / _SENTINEL_FILE).write_text(
        _hash_exclusion_set(exclusions) + "\n",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a0050cdf5a60189d — Filesystem access.
pkgs/python/[email protected]/scripts/data_sources.py:187 
    stored = sentinel.read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c127f394f240c7d3 — Filesystem access.
pkgs/python/[email protected]/scripts/diagnose_accuracy.py:73 
        data = filepath.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a1ad182ddf431f2b — Filesystem access.
pkgs/python/[email protected]/scripts/exclusions.py:81 
                raw_bytes = filepath.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #35cd4be2f49568f0 — Filesystem access.
pkgs/python/[email protected]/scripts/profile_detection.py:65 
        data = filepath.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #888e1f75c70d035e — Filesystem access.
pkgs/python/[email protected]/scripts/profile_detection.py:75 
        warmup_data = test_files[0][2].read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b9f0a906640f9bb5 — Filesystem access.
pkgs/python/[email protected]/scripts/profile_detection.py:83 
        data = filepath.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0e99b65b958f2051 — Environment-variable access.
pkgs/python/[email protected]/scripts/profile_detection.py:330 
            env={**os.environ, "HATCH_BUILD_HOOK_ENABLE_MYPYC": "true"},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6e1efb92b518b1da — Environment-variable access.
pkgs/python/[email protected]/scripts/profile_detection.py:368 
                **os.environ,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9d4bcae6624f46b6 — Environment-variable access.
pkgs/python/[email protected]/scripts/profile_detection.py:370 
                "PATH": f"{venv_dir / 'bin'}:{os.environ.get('PATH', '')}",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8224dcaf765fa4e3 — Filesystem access.
pkgs/python/[email protected]/scripts/train.py:163 
    data = input_path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e4635d01f4aeb030 — Filesystem access.
pkgs/python/[email protected]/scripts/train.py:383 
    path.write_text("\n".join(lines) + "\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #62034926499c02a5 — Filesystem access.
pkgs/python/[email protected]/scripts/utils.py:76 
        (local_data / _REF_FILE).write_text(ref_label + "\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e9fa0d68979145ab — Filesystem access.
pkgs/python/[email protected]/scripts/utils.py:99 
        if ref_file.is_file() and ref_file.read_text().strip() == desired_label:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c3be48eaaf2b51ad — Filesystem access.
pkgs/python/[email protected]/scripts/utils.py:270 
    return [(enc, lang, fp, fp.read_bytes()) for enc, lang, fp in test_files]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1b68eb2def157082 — Filesystem access.
pkgs/python/[email protected]/scripts/verify_no_overlap.py:45 
                text = article_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4d44897cf3b01ec — Filesystem access.
pkgs/python/[email protected]/src/chardet/models/__init__.py:104 
    data = ref.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fcfd16afb23cb41f — Filesystem access.
pkgs/python/[email protected]/src/chardet/models/__init__.py:195 
    data = ref.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1bbd2ee575d6e5e — Filesystem access.
pkgs/python/[email protected]/src/chardet/pipeline/confusion.py:121 
    raw = ref.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cryptography

python dependency
expand_more 26 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #01ea3213cc13371c — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:88 
with open(os.path.join(base_dir, "src", "cryptography", "__about__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #454aacb34e1f83d0 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/aes-192-gcm-siv/generate_aes192gcmsiv.py:52 
    with open(filename) as vector_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #77cfe7fee204f1f0 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/aes-192-gcm-siv/generate_aes192gcmsiv.py:81 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #80ba551a9f01a3af — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/arc4/generate_arc4.py:92 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #57a53066e882cd2b — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/cast5/generate_cast5.py:28 
    with open(filename) as vector_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4825cd717fea2b58 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/cast5/generate_cast5.py:52 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #87d9105961121af2 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/chacha20/generate_chacha20_overflow.py:42 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3b94874f804bd7ae — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/chacha20/verify_chacha20_overflow.py:49 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #57c027772dfee767 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/hkdf/generate_hkdf.py:34 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a0879c265ec24eee — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/idea/generate_idea.py:18 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0574a42496321b32 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/idea/generate_idea.py:50 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #581c2fc4c487718f — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/idea/verify_idea.py:22 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ecd5df2ea3eeb59e — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/rsa-oaep-sha2/generate_rsa_oaep_sha2.py:98 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #28ccc15aa0f9d980 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/seed/generate_seed.py:18 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4e0ab07ef2473dd1 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/seed/generate_seed.py:49 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c14bc1bce94c0f33 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/seed/verify_seed.py:20 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d97bfdfb9453df0 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:64 
        rustflags = os.environ.get("RUSTFLAGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #542e04bd713b0a7e — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:239 
    rustflags = os.environ.get("RUSTFLAGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b8505af8d020967 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:291 
    if "CARGO_INCREMENTAL" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a92097a886e638e8 — Filesystem access.
pkgs/python/[email protected]/noxfile.py:406 
        with open(f"{uuid.uuid4()}.lcov", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35fef6be73df0c23 — Filesystem access.
pkgs/python/[email protected]/release.py:54 
    content = p.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #904995b5503be640 — Filesystem access.
pkgs/python/[email protected]/release.py:60 
    p.write_text(new_content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb4bf55cec961dce — Environment-variable access.
pkgs/python/[email protected]/src/_cffi_src/build_openssl.py:49 
    out_dir = os.environ["OUT_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ecae325092dccd3e — Environment-variable access.
pkgs/python/[email protected]/src/_cffi_src/openssl/x509v3.py:13 
USE_CONST_X509 = bool(os.environ.get("USE_CONST_X509"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #736008ff172ba705 — Filesystem access.
pkgs/python/[email protected]/src/_cffi_src/utils.py:16 
with open(os.path.join(base_src, "cryptography", "__about__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aecd6ae2b891a6dd — Environment-variable access.
pkgs/python/[email protected]/src/cryptography/hazmat/bindings/openssl/binding.py:114 
    and os.environ.get("PROCESSOR_ARCHITEW6432") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

docx2txt

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #ca7e126e60423df3 — Filesystem access.
pkgs/python/[email protected]/docx2txt/docx2txt.py:103 
                with open(dst_fname, "wb") as dst_f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fake-useragent

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #d2a4f628997964a5 — Filesystem access.
pkgs/python/[email protected]/src/fake_useragent/utils.py:77 
        for line in json_path.read_text().splitlines():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fastapi

python dependency
expand_more 54 low-confidence finding(s)
low env_fs dependency Excluded from app score #04aaafeb505c8c07 — Filesystem access.
pkgs/python/[email protected]/docs_src/background_tasks/tutorial001_py310.py:7 
    with open("log.txt", mode="w") as email_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02c5da157883c7b4 — Filesystem access.
pkgs/python/[email protected]/docs_src/background_tasks/tutorial002_an_py310.py:9 
    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bf9d4ff67074b38 — Filesystem access.
pkgs/python/[email protected]/docs_src/background_tasks/tutorial002_py310.py:7 
    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae58e6fc4424acc3 — Filesystem access.
pkgs/python/[email protected]/docs_src/custom_response/tutorial008_py310.py:11 
        with open(some_file_path, mode="rb") as file_like:  # (2)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6d007a7c180599f — Filesystem access.
pkgs/python/[email protected]/docs_src/events/tutorial002_py310.py:8 
    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08a7a2ee129c57b8 — Filesystem access.
pkgs/python/[email protected]/docs_src/generate_clients/tutorial004_py310.py:5 
openapi_content = json.loads(file_path.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32718ee153e009a8 — Filesystem access.
pkgs/python/[email protected]/docs_src/generate_clients/tutorial004_py310.py:15 
file_path.write_text(json.dumps(openapi_content))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f6cfbef66fb9ff37 — Filesystem access.
pkgs/python/[email protected]/scripts/add_latest_release_date.py:12 
    with open(RELEASE_NOTES_FILE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b81175849f4e5aff — Filesystem access.
pkgs/python/[email protected]/scripts/add_latest_release_date.py:31 
        with open(RELEASE_NOTES_FILE, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #b4b4249817dc9244 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/contributors.py:129 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #fe082c6fa6ebf5d1 — Filesystem access.
pkgs/python/[email protected]/scripts/contributors.py:227 
    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #047f4b816eb05512 — Filesystem access.
pkgs/python/[email protected]/scripts/contributors.py:233 
    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ce52ba9cfe0cc5db — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:104 
    return yaml.unsafe_load(en_config_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #121d4b9122fd819a — Environment-variable access.
pkgs/python/[email protected]/scripts/docs.py:128 
    os.environ["DYLD_FALLBACK_LIBRARY_PATH"] = "/opt/homebrew/lib"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #32374356129cc107 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:142 
    new_llm_prompt_path.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5aa110227e381264 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:222 
    missing_translation = (docs_path / "missing-translation.md").read_text(
        encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #13d86307f62f97aa — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:228 
    translation_banner = translation_banner_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b64dd71a1b85ea35 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:235 
                markdown = translated_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a13312586a814360 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:237 
                    staged_file.write_text(markdown, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ddf83b58abc717c6 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:241 
                staged_file.write_text(
                    add_markdown_notice(markdown, banner), encoding="utf-8"
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b0bdd7f50c2478dc — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:245 
                markdown = staged_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9f531a0c53439ee8 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:246 
                staged_file.write_text(
                    add_markdown_notice(markdown, missing_translation),
                    encoding="utf-8",
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4f784473c251cbc7 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:275 
    config_path.write_text(
        yaml.dump(config, sort_keys=False, width=200, allow_unicode=True),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #904bb04d248eafdc — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:293 
    config = yaml.unsafe_load(config_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #55776beaf0532296 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:343 
    content = en_index.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #76fec4ee5ac2e826 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:349 
    sponsors = yaml.safe_load(sponsors_data_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4bc49c9d06a5b198 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:378 
    old_content = readme_path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #161cf901096e19ae — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:383 
        readme_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fadd8efd7adf8066 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:424 
        en_config_path.write_text(
            yaml.dump(updated_config, sort_keys=False, width=200, allow_unicode=True),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f0282873c8a3219a — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:481 
        language_names_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f0293c217539c729 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:552 
    base_content = file_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ef6a703bb50cf6ae — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:600 
        version_file.write_text(content_format, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a64e3bd6a3fdb57b — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:656 
        content = md_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3ccc4508a46cab4b — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:663 
            md_file.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a50c54531f3b3b37 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:678 
        all_docs_content += md_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #bab254276fb49996 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/notify_translations.py:218 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #e5b3878e27b88923 — Filesystem access.
pkgs/python/[email protected]/scripts/notify_translations.py:319 
    contents = settings.github_event_path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #217c2dc977918c5c — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/people.py:202 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #1f77cc322976361e — Filesystem access.
pkgs/python/[email protected]/scripts/people.py:384 
    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #45791dec42feaa6f — Filesystem access.
pkgs/python/[email protected]/scripts/people.py:390 
    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #d0ebc032c0575f37 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/sponsors.py:100 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #86ad9fc22379acdc — Filesystem access.
pkgs/python/[email protected]/scripts/sponsors.py:148 
    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8aa8da7e1930aef9 — Filesystem access.
pkgs/python/[email protected]/scripts/sponsors.py:154 
    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a3ed5625eff9e035 — Filesystem access.
pkgs/python/[email protected]/scripts/topic_repos.py:52 
    repos_old_content = repos_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4841fa238b893ecb — Filesystem access.
pkgs/python/[email protected]/scripts/topic_repos.py:57 
    repos_path.write_text(new_repos_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #aa809cc00564ff16 — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:31 
general_prompt = general_prompt_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3bf7c351a7798e2d — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:38 
    return yaml.safe_load(Path("docs/language_names.yml").read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #edeaafceb38d55cd — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:121 
    lang_prompt_content = lang_prompt_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #098af673785ffcce — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:129 
    original_content = en_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b10072f99aa992d5 — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:133 
        old_translation = out_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2505468fbc478efe — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:178 
    out_path.write_text(out_content, encoding="utf-8", newline="\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1e25b5eec28b09b1 — Filesystem access.
pkgs/python/[email protected]/scripts/translation_fixer.py:81 
        doc_lines = path.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6fdf8fddc5d7c534 — Filesystem access.
pkgs/python/[email protected]/scripts/translation_fixer.py:82 
        en_doc_lines = en_doc_path.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #747e65ed83a5091e — Filesystem access.
pkgs/python/[email protected]/scripts/translation_fixer.py:94 
        path.write_text("\n".join(doc_lines), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fpdf2

python dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #99a34dcb64f4a535 — Filesystem access.
pkgs/python/[email protected]/fpdf/fpdf.py:5722 
        with open(pkcs_filepath, "rb") as pkcs_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e12d047c276bb117 — Filesystem access.
pkgs/python/[email protected]/fpdf/image_parsing.py:228 
    with open(filename, "rb") as local_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #867667562620f429 — Filesystem access.
pkgs/python/[email protected]/fpdf/svg.py:856 
        with open(filename, "r", encoding=encoding) as svgfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #570c50c681fc1007 — Filesystem access.
pkgs/python/[email protected]/fpdf/template.py:186 
        with open(infile, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef54c1b06dd68da5 — Filesystem access.
pkgs/python/[email protected]/fpdf/template.py:257 
        with open(infile, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb80e6e429899595 — Filesystem access.
pkgs/python/[email protected]/fpdf/util.py:214 
    return (resources.files(pkg) / "sRGB2014.icc").read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ftfy

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #ad55678596344195 — Filesystem access.
pkgs/python/[email protected]/ftfy/cli.py:104 
        file = open(args.filename, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b346bbf31aea3c3 — Filesystem access.
pkgs/python/[email protected]/ftfy/cli.py:112 
        outfile = open(args.output, "w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-genai

python dependency
expand_more 43 low-confidence finding(s)
low env_fs dependency Excluded from app score #56df19b45e74e627 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:102 
  env_google_api_key = os.environ.get('GOOGLE_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88e2a582e0ff1002 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:103 
  env_gemini_api_key = os.environ.get('GEMINI_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83e752ca074bd22d — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:188 
  os.environ['GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES'] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54b5b71c8e8633f9 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:566 
      if os.environ.get('GOOGLE_GENAI_USE_VERTEXAI', '0').lower() in [

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72bcbaca67b6ae74 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:603 
    env_project = os.environ.get('GOOGLE_CLOUD_PROJECT', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82b49c088920bebb — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:604 
    env_location = os.environ.get('GOOGLE_CLOUD_LOCATION', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad23182708f812e1 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:839 
          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d4871afc763b59f — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:840 
          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa40b16238ad85b7 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:896 
          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ea9a91aee87a360 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:897 
          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76b5955745dd1c67 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:954 
          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #267c36e05769ba1e — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:955 
          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c099690c6ab40e02 — Filesystem access.
pkgs/python/[email protected]/google/genai/_api_client.py:1513 
      with open(file_path, 'rb') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58825a0d4b3614dc — Environment-variable access.
pkgs/python/[email protected]/google/genai/_base_url.py:48 
    return _default_base_vertex_url or os.getenv('GOOGLE_VERTEX_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cdc3f28fcb1ebd2 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_base_url.py:50 
    return _default_base_gemini_url or os.getenv('GOOGLE_GEMINI_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c8f4986a03b7823 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_interactions/_client.py:103 
            api_key = os.environ.get("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d490158ac9cf68ad — Environment-variable access.
pkgs/python/[email protected]/google/genai/_interactions/_client.py:111 
            base_url = os.environ.get("GEMINI_NEXT_GEN_API_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee9645bd011e090b — Environment-variable access.
pkgs/python/[email protected]/google/genai/_interactions/_client.py:324 
            api_key = os.environ.get("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb3830773d69d5a9 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_interactions/_client.py:332 
            base_url = os.environ.get("GEMINI_NEXT_GEN_API_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8acbf4994b1a3df — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_files.py:83 
            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #774cac56c3e796dd — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_files.py:95 
        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #480614d986219a47 — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_files.py:125 
            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04998fe67f119f9c — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_files.py:137 
        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a16947cb014a030 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_interactions/_models.py:126 
            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #399647845564a9b9 — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_response.py:512 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76772cd76e0cfa56 — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_response.py:554 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea4527586c5f819f — Environment-variable access.
pkgs/python/[email protected]/google/genai/_interactions/_utils/_logs.py:32 
    env = os.environ.get("GEMINI_NEXT_GEN_API_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb31f0a935f23aa9 — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_utils/_transform.py:263 
            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #814beaf3d3fa43f4 — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_utils/_transform.py:429 
            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e796985618b26a3 — Filesystem access.
pkgs/python/[email protected]/google/genai/_interactions/_utils/_utils.py:383 
    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44f786d548e0d03e — Filesystem access.
pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:105 
  with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0da687ece10ba5f — Filesystem access.
pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:122 
    with open(tmp_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5a190cddd0c400d — Environment-variable access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:198 
      os.environ.get('PYTEST_CURRENT_TEST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #753d4c18112af5c3 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:290 
      self.replays_directory = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59350f130d2c3055 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:290 
      self.replays_directory = os.environ.get(
          'GOOGLE_GENAI_REPLAYS_DIRECTORY', None
      )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6ab702a01aeebbd — Filesystem access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:334 
      with open(replay_file_path, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a7532098367ce46 — Filesystem access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:361 
    with open(replay_file_path, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #319d3490381b1a1d — Environment-variable access.
pkgs/python/[email protected]/google/genai/client.py:299 
      default_factory=lambda: os.getenv('GOOGLE_GENAI_CLIENT_MODE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb861275494523a8 — Environment-variable access.
pkgs/python/[email protected]/google/genai/client.py:303 
      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAYS_DIRECTORY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c15e0d2200ab9f54 — Environment-variable access.
pkgs/python/[email protected]/google/genai/client.py:307 
      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAY_ID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44711464616504c2 — Filesystem access.
pkgs/python/[email protected]/google/genai/types.py:8244 
    image_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62fe4a1181e079e5 — Filesystem access.
pkgs/python/[email protected]/google/genai/types.py:10396 
    video_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18d08955414fbcb7 — Filesystem access.
pkgs/python/[email protected]/google/genai/types.py:19781 
    with open(file_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #d7321d327a8a8f2d — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:34 
        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c5158d6c262cb40 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:35 
            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #682540541706e2d2 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:36 
        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e93604aba3b418ec — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:37 
            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

katex

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #f0917f394f1a5a0d — Filesystem access.
pkgs/python/[email protected]/src/metrics/parse_tfm.py:134 
    with open(file_name, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langchain

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #2dc422dd7a8d1437 — Environment-variable access.
pkgs/python/[email protected]/langchain/agents/middleware/_execution.py:322 
        host_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b2822e74cdbab5e — Filesystem access.
pkgs/python/[email protected]/langchain/agents/middleware/file_search.py:341 
                content = file_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8cdf547a891ec306 — Filesystem access.
pkgs/python/[email protected]/scripts/check_version.py:15 
    content = pyproject_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d3449b67e55431ad — Filesystem access.
pkgs/python/[email protected]/scripts/check_version.py:22 
    content = init_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langchain-classic

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #120f154d8606a70a — Filesystem access.
pkgs/python/[email protected]/langchain_classic/storage/file_system.py:118 
                value = full_path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langchain-text-splitters

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #7ccf40540f1cad85 — Filesystem access.
pkgs/python/[email protected]/langchain_text_splitters/html.py:240 
            html_content = pathlib.Path(file).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

loguru

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #f7ce8a36cecd2e3e — Environment-variable access.
pkgs/python/[email protected]/loguru/_colorama.py:25 
        if "CI" in os.environ and any(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4a25fda2c978ff0 — Environment-variable access.
pkgs/python/[email protected]/loguru/_colorama.py:26 
            ci in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d32fc563d310c40d — Environment-variable access.
pkgs/python/[email protected]/loguru/_colorama.py:30 
        if "PYCHARM_HOSTED" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dabae099df4e7833 — Environment-variable access.
pkgs/python/[email protected]/loguru/_colorama.py:32 
        if os.name == "nt" and "TERM" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41a7c5f7fdbbfeef — Environment-variable access.
pkgs/python/[email protected]/loguru/_defaults.py:5 
    if key not in environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fb0adcf61c19c13 — Environment-variable access.
pkgs/python/[email protected]/loguru/_defaults.py:8 
    val = environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48fd9b09542f51b6 — Filesystem access.
pkgs/python/[email protected]/loguru/_file_sink.py:53 
        with open(path_in, "rb") as f_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d3f49692f1627ae — Filesystem access.
pkgs/python/[email protected]/loguru/_file_sink.py:226 
        self._file = open(path, **self._kwargs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3aa7de6e4f95f63b — Filesystem access.
pkgs/python/[email protected]/loguru/_logger.py:1868 
                with open(str(file)) as fileobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

nltk

python dependency
expand_more 95 low-confidence finding(s)
low env_fs dependency Excluded from app score #e162a9cf232f0cbf — Filesystem access.
pkgs/python/[email protected]/nltk/__init__.py:33 
    with open(version_file) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8152e72f69e787e7 — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:798 
            with open(filename, "wb") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81d9ffb77ab63323 — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:815 
        with open(filename, "rb") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a11e8334c3c06cff — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:2272 
            with open(filename, "rb") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5de5ea5565567733 — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:2295 
            with open(filename, "wb") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4857fcc3b87e2d94 — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:2310 
                with open(filename, "rb") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dad326d24400cb39 — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:2313 
                with open(filename) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3899a2902948dbf — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:2327 
                with open(filename, "wb") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0bae0c0ead8a92d — Filesystem access.
pkgs/python/[email protected]/nltk/app/chartparser_app.py:2330 
                with open(filename, "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0aab06a18a7d926a — Filesystem access.
pkgs/python/[email protected]/nltk/app/chunkparser_app.py:1394 
        with open(filename, "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e1a3f1cf2dccfe5 — Filesystem access.
pkgs/python/[email protected]/nltk/app/chunkparser_app.py:1415 
        with open(filename) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90daf01dc4b0bd2b — Filesystem access.
pkgs/python/[email protected]/nltk/app/chunkparser_app.py:1430 
        with open(filename, "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #461e0b81a64c75c2 — Filesystem access.
pkgs/python/[email protected]/nltk/app/wordnet_app.py:110 
                    with open(usp) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20f70a5659f055e8 — Filesystem access.
pkgs/python/[email protected]/nltk/app/wordnet_app.py:224 
            logfile = open(logfilename, "a", 1)  # 1 means 'line buffering'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cb00ab916bd53d7 — Filesystem access.
pkgs/python/[email protected]/nltk/chunk/named_entity.py:235 
    with open(annfile) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #757d638507f8fbf9 — Filesystem access.
pkgs/python/[email protected]/nltk/chunk/named_entity.py:247 
    with open(textfile) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57bce10e09f573f9 — Filesystem access.
pkgs/python/[email protected]/nltk/classify/maxent.py:1440 
        with open(trainfile_name, "w") as trainfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45c043bd7033955e — Filesystem access.
pkgs/python/[email protected]/nltk/classify/maxent.py:1542 
        with open(weightfile_name) as weightfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c08166e1d167568 — Filesystem access.
pkgs/python/[email protected]/nltk/classify/maxent.py:1596 
    with open(f"{tab_dir}/weights.txt", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf51817121a26d9a — Filesystem access.
pkgs/python/[email protected]/nltk/classify/maxent.py:1598 
    with open(f"{tab_dir}/mapping.tab", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8e3c442fe3ff0ac — Filesystem access.
pkgs/python/[email protected]/nltk/classify/maxent.py:1600 
    with open(f"{tab_dir}/labels.txt", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47ab46e89457dbe9 — Filesystem access.
pkgs/python/[email protected]/nltk/classify/maxent.py:1602 
    with open(f"{tab_dir}/alwayson.tab", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce76b0f6035b3948 — Environment-variable access.
pkgs/python/[email protected]/nltk/classify/senna.py:59 
            if "SENNA" in environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2a16f9a52bb4c07 — Environment-variable access.
pkgs/python/[email protected]/nltk/classify/senna.py:61 
                self._path = path.normpath(environ["SENNA"]) + sep

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75b5e9f14993887b — Environment-variable access.
pkgs/python/[email protected]/nltk/classify/weka.py:45 
        if "WEKAHOME" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c245f9004d1986d7 — Environment-variable access.
pkgs/python/[email protected]/nltk/classify/weka.py:46 
            searchpath.insert(0, os.environ["WEKAHOME"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c640668c66788346 — Filesystem access.
pkgs/python/[email protected]/nltk/classify/weka.py:277 
            outfile = open(outfile, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7b28526533fef5c — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/crubadan.py:78 
        with open(mapper_file, encoding="utf-8") as raw:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c122cfc2ad959e9 — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/crubadan.py:97 
        with open(ngram_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba969847000ec701 — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/ipipan.py:191 
        with open(f) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7ad7a87867d6e56 — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/lin.py:43 
            with open(path) as lin_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #328a18f3fd6e9caf — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/nkjp.py:256 
            fr = open(self.read_file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2fb3520b79aa30c — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/pl196x.py:110 
            with open(self._textids) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d038efe18aa60248 — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/util.py:212 
                open(self._fileid, "rb"), self._encoding

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ae0deeaf892f2f6 — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/util.py:215 
            self._stream = open(self._fileid, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60a4133aa099d0b6 — Filesystem access.
pkgs/python/[email protected]/nltk/corpus/reader/xmldocs.py:161 
            with open(fileid, "rb") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74dae8b127b96779 — Environment-variable access.
pkgs/python/[email protected]/nltk/data.py:94 
_paths_from_env = os.environ.get("NLTK_DATA", "").split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43b83a95e89ae914 — Environment-variable access.
pkgs/python/[email protected]/nltk/data.py:96 
if "APPENGINE_RUNTIME" not in os.environ and os.path.expanduser("~/") != "~/":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5153ab2fbe124a2 — Environment-variable access.
pkgs/python/[email protected]/nltk/data.py:105 
        os.path.join(os.environ.get("APPDATA", "C:\\"), "nltk_data"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9af071c46d2064fc — Filesystem access.
pkgs/python/[email protected]/nltk/data.py:769 
    with open(filename, "wb") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5ac2f44bcd7b4a6 — Filesystem access.
pkgs/python/[email protected]/nltk/downloader.py:719 
            with open(filepath, "wb") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d88171e5a62284f — Environment-variable access.
pkgs/python/[email protected]/nltk/downloader.py:1094 
        if "APPENGINE_RUNTIME" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aacaa9449d3df5dc — Environment-variable access.
pkgs/python/[email protected]/nltk/downloader.py:1104 
        if sys.platform == "win32" and "APPDATA" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5ffce5553d1201d — Environment-variable access.
pkgs/python/[email protected]/nltk/downloader.py:1105 
            homedir = os.environ["APPDATA"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #331d5e55e3df13d6 — Environment-variable access.
pkgs/python/[email protected]/nltk/downloader.py:1140 
            os.environ.get("NLTK_DOWNLOADER_FORCE_INTERACTIVE_SHELL", "false").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61d41529ba1817e2 — Filesystem access.
pkgs/python/[email protected]/nltk/downloader.py:2282 
        with open(file, "rb") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84c2b6e7d2eaefcc — Filesystem access.
pkgs/python/[email protected]/nltk/downloader.py:2303 
        with open(file, "rb") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db2ad724dbeecf1b — Environment-variable access.
pkgs/python/[email protected]/nltk/downloader.py:2720 
        default=os.environ.get("NLTK_DOWNLOAD_URL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8743d171afc0bd17 — Filesystem access.
pkgs/python/[email protected]/nltk/draw/util.py:1870 
        with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12e3728abdaf7726 — Environment-variable access.
pkgs/python/[email protected]/nltk/internals.py:545 
        if env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85e8accd9b3fe516 — Environment-variable access.
pkgs/python/[email protected]/nltk/internals.py:548 
                yield os.environ[env_var]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43bb354a25bd2465 — Environment-variable access.
pkgs/python/[email protected]/nltk/internals.py:550 
            for env_dir in os.environ[env_var].split(os.pathsep):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e8139e768097ac7 — Environment-variable access.
pkgs/python/[email protected]/nltk/internals.py:727 
        if env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a8801a5a06db783 — Environment-variable access.
pkgs/python/[email protected]/nltk/internals.py:729 
                classpath = os.environ["CLASSPATH"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #570c0a505d15f409 — Environment-variable access.
pkgs/python/[email protected]/nltk/internals.py:767 
                jar_env = os.path.expanduser(os.environ[env_var])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3ece3c2734f84a2 — Filesystem access.
pkgs/python/[email protected]/nltk/metrics/agreement.py:440 
    with open(options.file) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27f277e4856a687e — Filesystem access.
pkgs/python/[email protected]/nltk/metrics/distance.py:297 
    with open(file) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34af021fbaf36a39 — Filesystem access.
pkgs/python/[email protected]/nltk/parse/dependencygraph.py:225 
        with open(filename) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48c53f6902bbebbe — Filesystem access.
pkgs/python/[email protected]/nltk/parse/malt.py:207 
                with open(output_file.name) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbea8553de65c142 — Filesystem access.
pkgs/python/[email protected]/nltk/parse/transitionparser.py:542 
            pickle.dump(model, open(modelfile, "wb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f64131ef7aae1fa3 — Filesystem access.
pkgs/python/[email protected]/nltk/parse/transitionparser.py:556 
        with open(modelFile, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9edf3c0c9aebbd94 — Environment-variable access.
pkgs/python/[email protected]/nltk/pathsec.py:39 
    env_paths = os.environ.get("NLTK_DATA", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e9b0899d914cfb4 — Filesystem access.
pkgs/python/[email protected]/nltk/sem/chat80.py:677 
        with open("chat_pnames.cfg", "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f5a47ece70ebd9e — Filesystem access.
pkgs/python/[email protected]/nltk/sentiment/sentiment_analyzer.py:190 
        with open(filename, "wb") as storage_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28db74639280eba9 — Filesystem access.
pkgs/python/[email protected]/nltk/tag/perceptron.py:108 
        with open(path, "w") as fout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1045b5327770b5c0 — Filesystem access.
pkgs/python/[email protected]/nltk/tag/perceptron.py:113 
        with open(path) as fin:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8612e294bc7b4ee2 — Filesystem access.
pkgs/python/[email protected]/nltk/tag/perceptron.py:272 
            with open(path_join(loc, json_file), "w") as fout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10da81912e65e1e8 — Filesystem access.
pkgs/python/[email protected]/nltk/tbl/demo.py:249 
            with open(cache_baseline_tagger, "wb") as print_rules:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6edc6fcc941b8e92 — Filesystem access.
pkgs/python/[email protected]/nltk/tbl/demo.py:256 
        with open(cache_baseline_tagger, "rb") as print_rules:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57835b5879fa4501 — Filesystem access.
pkgs/python/[email protected]/nltk/tbl/demo.py:317 
        with open(error_output, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48a8a9d6037be895 — Filesystem access.
pkgs/python/[email protected]/nltk/tbl/demo.py:325 
        with open(serialize_output, "wb") as print_rules:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee02a23b97b4cedf — Filesystem access.
pkgs/python/[email protected]/nltk/tbl/demo.py:328 
        with open(serialize_output, "rb") as print_rules:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f63b07011ddb466e — Filesystem access.
pkgs/python/[email protected]/nltk/tokenize/punkt.py:1593 
        with open("/tmp/punkt.new", "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37407ffe8146b7f2 — Filesystem access.
pkgs/python/[email protected]/nltk/tokenize/punkt.py:1788 
    with open(f"{dir}/collocations.tab", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3eb28abd093e1ee9 — Filesystem access.
pkgs/python/[email protected]/nltk/tokenize/punkt.py:1790 
    with open(f"{dir}/sent_starters.txt", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cb2f1a9e1194e38 — Filesystem access.
pkgs/python/[email protected]/nltk/tokenize/punkt.py:1792 
    with open(f"{dir}/abbrev_types.txt", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2088b891bdaaca7 — Filesystem access.
pkgs/python/[email protected]/nltk/tokenize/punkt.py:1794 
    with open(f"{dir}/ortho_context.tab", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #504fe99300c17c6d — Environment-variable access.
pkgs/python/[email protected]/nltk/tokenize/stanford_segmenter.py:131 
        if os.environ.get("STANFORD_SEGMENTER"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #617f8e4a7eacee29 — Environment-variable access.
pkgs/python/[email protected]/nltk/tokenize/stanford_segmenter.py:132 
            search_path = {os.path.join(os.environ.get("STANFORD_SEGMENTER"), "data")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18c7b6a77b80d447 — Filesystem access.
pkgs/python/[email protected]/nltk/tokenize/stanford_segmenter.py:290 
            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16e4bf1a60efd43c — Environment-variable access.
pkgs/python/[email protected]/nltk/tokenize/stanford_segmenter.py:296 
            user_checksum = os.environ.get("NLTK_SEGMENTER_ALLOW_SHA256")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fea4b07af0b0159d — Filesystem access.
pkgs/python/[email protected]/nltk/twitter/common.py:142 
        outf = open(outfile, "w", newline="", encoding=encoding, errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21dcecbf87510a18 — Filesystem access.
pkgs/python/[email protected]/nltk/twitter/twitterclient.py:524 
                self.output = open(self.fname, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #465348e7d163db65 — Environment-variable access.
pkgs/python/[email protected]/nltk/twitter/util.py:39 
            self.twitter_dir = os.environ["TWITTER"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #191f999a3daebbf4 — Filesystem access.
pkgs/python/[email protected]/nltk/twitter/util.py:86 
        with open(self.creds_fullpath) as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7316db35b7db6232 — Filesystem access.
pkgs/python/[email protected]/nltk/twitter/util.py:133 
    with open(creds_file, "a") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc9e748b421261e8 — Filesystem access.
pkgs/python/[email protected]/setup.py:25 
with open(version_file) as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a29f697e38634b54 — Filesystem access.
pkgs/python/[email protected]/tools/find_deprecated.py:127 
                s = open(os.path.join(root, filename)).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #824647db0278cecc — Filesystem access.
pkgs/python/[email protected]/tools/find_deprecated.py:160 
            print_deprecated_uses_in(open(path).readline, path, dep_files, dep_names, 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ac97499404f26e81 — Filesystem access.
pkgs/python/[email protected]/tools/find_deprecated.py:162 
            for example in DocTestParser().get_examples(open(path).read()):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #da3683837a1e5135 — Filesystem access.
pkgs/python/[email protected]/tools/global_replace.py:27 
        s = open(file, "rb").read().decode("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #66e4990840c1d446 — Filesystem access.
pkgs/python/[email protected]/tools/global_replace.py:29 
        out = open(file, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ead689f5839cf3a3 — Filesystem access.
pkgs/python/[email protected]/web/conf.py:65 
    with open(
        os.path.join(web_folder, "_templates", "doctest.rst"), encoding="utf8"
    ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7971b88ce6512e33 — Filesystem access.
pkgs/python/[email protected]/web/conf.py:88 
    with open(os.path.join(web_folder, "team", "team.json"), encoding="utf8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f1cad8adcbc076c — Filesystem access.
pkgs/python/[email protected]/web/conf.py:93 
    with open(
        os.path.join(web_folder, "_templates", "team.html"), encoding="utf8"
    ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

opensearch-py

python dependency
expand_more 11 low-confidence finding(s)
low env_fs dependency Excluded from app score #0fc9523120058e3e — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/_async/helpers/test.py:17 
OPENSEARCH_URL = os.environ.get("OPENSEARCH_URL", "https://localhost:9200")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a31365ed52e5062 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/connection/base.py:100 
        if os.getenv("ELASTIC_CLIENT_APIVERSIONING") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #846c7adf433e23b4 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/connection/base.py:329 
        ca_certs = os.environ.get("SSL_CERT_FILE") or os.environ.get("SSL_CERT_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cbf8352b5c2df70 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:37 
OPENSEARCH_URL = os.environ.get("OPENSEARCH_URL", "https://localhost:9200")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3341c4452c088e9 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:44 
    if "PYTHON_CONNECTION_CLASS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3ce3c2cabdfd063 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:48 
            connection, os.environ["PYTHON_CONNECTION_CLASS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27853dd7a53b4dc3 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:107 
if "OPENSEARCH_VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #646f9807ba2f7dc2 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:108 
    OPENSEARCH_VERSION = _get_version(os.environ["OPENSEARCH_VERSION"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9fbfd07c440db3f — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:113 
            http_auth=("admin", os.getenv("OPENSEARCH_PASSWORD", "admin")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b486c2b81c655936 — Filesystem access.
pkgs/python/[email protected]/setup.py:37 
with open(
    join(BASE_DIR, PACKAGE_NAME.replace("-", ""), "_version.py"), encoding="utf-8"
) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd491e43c69a7c48 — Filesystem access.
pkgs/python/[email protected]/setup.py:47 
with open(join(BASE_DIR, "README.md"), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

psycopg

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #819200ee83754872 — Environment-variable access.
pkgs/python/[email protected]/psycopg/_conninfo_utils.py:81 
    if (env := os.environ.get(paramdef.envvar)) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b6b579058be5d96 — Environment-variable access.
pkgs/python/[email protected]/psycopg/_dns.py:138 
        if params.get("hostaddr", os.environ.get("PGHOSTADDR", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36aeb9d82feb646c — Environment-variable access.
pkgs/python/[email protected]/psycopg/_dns.py:141 
        host_arg: str = params.get("host", os.environ.get("PGHOST", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bbd11a11b8b94c1 — Environment-variable access.
pkgs/python/[email protected]/psycopg/_dns.py:143 
        port_arg: str = str(params.get("port", os.environ.get("PGPORT", "")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7be1b695257dd739 — Environment-variable access.
pkgs/python/[email protected]/psycopg/pq/__init__.py:61 
    impl = os.environ.get("PSYCOPG_IMPL", "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abc6c3f8172eac40 — Filesystem access.
pkgs/python/[email protected]/psycopg/pq/_pq_ctypes.py:807 
    with open(fn) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e792bb53eabb74c — Filesystem access.
pkgs/python/[email protected]/psycopg/pq/_pq_ctypes.py:838 
    with open(fn, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6885606d61942dc6 — Environment-variable access.
pkgs/python/[email protected]/psycopg/waiting.py:437 
if "PSYCOPG_WAIT_FUNC" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b5451c8ffc6743a — Environment-variable access.
pkgs/python/[email protected]/psycopg/waiting.py:438 
    fname = os.environ["PSYCOPG_WAIT_FUNC"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pyarrow

python dependency
expand_more 19 low-confidence finding(s)
low env_fs dependency Excluded from app score #d5daa502c92c48e4 — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:311 
    return _os.environ.get('PKG_CONFIG', 'pkg-config')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f176a8955054b158 — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:400 
    pkg_config_executable = _os.environ.get('PKG_CONFIG') or 'pkg-config'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #777811fe9d0232b0 — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:432 
    if _os.environ.get('ARROW_HOME'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b65e4805991f15e — Environment-variable access.
pkgs/python/[email protected]/pyarrow/__init__.py:433 
        append_library_dir(_os.path.join(_os.environ['ARROW_HOME'], 'lib'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20401b7f5a253e93 — Environment-variable access.
pkgs/python/[email protected]/pyarrow/ipc.py:138 
            bool(int(os.environ.get('ARROW_PRE_0_15_IPC_FORMAT', '0')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97ff4fe6742d1eec — Environment-variable access.
pkgs/python/[email protected]/pyarrow/ipc.py:139 
    if bool(int(os.environ.get('ARROW_PRE_1_0_METADATA_VERSION', '0'))):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50de208f37ddefd2 — Filesystem access.
pkgs/python/[email protected]/pyarrow/util.py:236 
        with open(out_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e57c2a4e3f7a86ae — Filesystem access.
pkgs/python/[email protected]/pyarrow/util.py:243 
        with open(out_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e7aced3a0beeb3b — Environment-variable access.
pkgs/python/[email protected]/setup.py:166 
        self.cmake_generator = os.environ.get('PYARROW_CMAKE_GENERATOR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98159cbba210ab38 — Environment-variable access.
pkgs/python/[email protected]/setup.py:169 
        self.extra_cmake_args = os.environ.get('PYARROW_CMAKE_OPTIONS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4dc5f7e5e789bb10 — Environment-variable access.
pkgs/python/[email protected]/setup.py:170 
        self.build_type = os.environ.get('PYARROW_BUILD_TYPE',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e561cb57f61ba52b — Environment-variable access.
pkgs/python/[email protected]/setup.py:170 
        self.build_type = os.environ.get('PYARROW_BUILD_TYPE',
                                         'release').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9067874ffe39400a — Environment-variable access.
pkgs/python/[email protected]/setup.py:173 
        self.cmake_cxxflags = os.environ.get('PYARROW_CXXFLAGS', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d5327471556f156 — Environment-variable access.
pkgs/python/[email protected]/setup.py:196 
            os.environ.get('PYARROW_GENERATE_COVERAGE', '0'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fac2453fb1c89e94 — Environment-variable access.
pkgs/python/[email protected]/setup.py:198 
            os.environ.get('PYARROW_BUNDLE_ARROW_CPP', '0'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d49090a7e2bc2837 — Environment-variable access.
pkgs/python/[email protected]/setup.py:200 
            os.environ.get('PYARROW_BUNDLE_CYTHON_CPP', '0'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c17d61834e7bd5e0 — Filesystem access.
pkgs/python/[email protected]/setup.py:255 
                cachefile = open('CMakeCache.txt', 'r')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d30c0d0b5c091da0 — Environment-variable access.
pkgs/python/[email protected]/setup.py:327 
                if os.environ.get('PYARROW_BUILD_VERBOSE', '0') == '1':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #841a69e3718c20f2 — Environment-variable access.
pkgs/python/[email protected]/setup.py:329 
                parallel = os.environ.get('PYARROW_PARALLEL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pydantic

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #688ccb48cf7f040b — Filesystem access.
pkgs/python/[email protected]/pydantic/deprecated/parse.py:71 
    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #592ce76f22b48937 — Environment-variable access.
pkgs/python/[email protected]/pydantic/json_schema.py:344 
                if os.getenv('PYDANTIC_PRIVATE_ALLOW_UNHANDLED_SCHEMA_TYPES'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfbccff2ca7ed063 — Filesystem access.
pkgs/python/[email protected]/pydantic/mypy.py:1411 
    with open(config_file, 'rb') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21786f2b40f4ea64 — Environment-variable access.
pkgs/python/[email protected]/pydantic/plugin/_loader.py:27 
    disabled_plugins = os.getenv('PYDANTIC_DISABLE_PLUGINS')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abd66af6506567ea — Environment-variable access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:173 
            env_vars: Mapping[str, Optional[str]] = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fefd5f5031a6f3e — Environment-variable access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:175 
            env_vars = {k.lower(): v for k, v in os.environ.items()}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6221c8880c98be55 — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:307 
                    secret_value = path.read_text().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57bf16979c0d7336 — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/mypy.py:948 
    with open(config_file, read_mode) as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35792a427ab6c8a4 — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/parse.py:57 
    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pymdown-extensions

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #823f6f60672d532e — Filesystem access.
pkgs/python/[email protected]/pymdownx/b64.py:86 
                    with open(file_name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #234dd40040c6d491 — Filesystem access.
pkgs/python/[email protected]/pymdownx/snippets.py:366 
                        with open(snippet, 'r', encoding=self.encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pypdf

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #0af841ad61bb6177 — Filesystem access.
pkgs/python/[email protected]/pypdf/_page.py:1896 
            debug_path.joinpath("fonts.json").write_text(
                json.dumps(fonts, indent=2, default=asdict),
                "utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91c3336fc1b22e09 — Filesystem access.
pkgs/python/[email protected]/pypdf/_reader.py:168 
            with open(stream, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d600673d94ef919 — Filesystem access.
pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:250 
        debug_path.joinpath("bt_groups.json").write_text(
            json.dumps(ty_groups, indent=2, default=str), "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e31ae8dfa9dc73f9 — Filesystem access.
pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:316 
        debug_path.joinpath("bts.json").write_text(
            json.dumps(bt_groups, indent=2, default=str), "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc7cba7b5d510657 — Filesystem access.
pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:319 
        debug_path.joinpath("tjs.json").write_text(
            json.dumps(
                tj_ops, indent=2, default=lambda x: getattr(x, "to_dict", str)(x)
            ),
            "utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8153a20e8a2c071c — Filesystem access.
pkgs/python/[email protected]/pypdf/_utils.py:368 
    with open("pypdf_pdfLocation.txt", "wb") as output_fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d15a01bb1b2ba2c — Filesystem access.
pkgs/python/[email protected]/pypdf/_writer.py:231 
                with open(fileobj, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b28395dae589a2b7 — Environment-variable access.
pkgs/python/[email protected]/pypdf/filters.py:719 
            environment = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #3f3c0e14694375c7 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/resources/afm_to_dataclass.py:24 
        with urllib.request.urlopen(
            f"https://{FONT_LOC}"
        ) as connection, ZipFile(BytesIO(

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

python-mimeparse

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #f6aef8088f881d31 — Filesystem access.
pkgs/python/[email protected]/mimeparse_test.py:24 
        with open("testdata.json") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-multipart

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #c85e35b1449c924b — Filesystem access.
pkgs/python/[email protected]/python_multipart/multipart.py:487 
                tmp_file = open(path, "w+b")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-pptx

python dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #8b7df2e4ab298ba8 — Filesystem access.
pkgs/python/[email protected]/features/steps/picture.py:43 
    with open(test_image(filename), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #957f9473c6bb9155 — Filesystem access.
pkgs/python/[email protected]/features/steps/placeholder.py:141 
    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #926141b606873b18 — Filesystem access.
pkgs/python/[email protected]/features/steps/presentation.py:88 
    with open(test_pptx("test"), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2df4f51134511fb6 — Filesystem access.
pkgs/python/[email protected]/features/steps/presentation.py:107 
    with open(saved_pptx_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #466fe2eac1c88e71 — Filesystem access.
pkgs/python/[email protected]/features/steps/shape.py:461 
    with open(test_file("just-two-mice.png"), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53b6b1b73ec59b2e — Filesystem access.
pkgs/python/[email protected]/features/steps/shapes.py:65 
    with open(test_file(filename), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2c68fc6bae85a86 — Filesystem access.
pkgs/python/[email protected]/src/pptx/media.py:37 
            with open(movie_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #523c6667e1ef0e0e — Filesystem access.
pkgs/python/[email protected]/src/pptx/opc/package.py:367 
            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d01e581bcf8494f1 — Filesystem access.
pkgs/python/[email protected]/src/pptx/opc/serialized.py:166 
            with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7abb8e80181fa26c — Filesystem access.
pkgs/python/[email protected]/src/pptx/oxml/__init__.py:29 
    with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9404747aed4d49e — Filesystem access.
pkgs/python/[email protected]/src/pptx/parts/image.py:163 
            with open(image_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a97eb0f1f8836b17 — Environment-variable access.
pkgs/python/[email protected]/src/pptx/text/fonts.py:80 
        home = os.environ.get("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8dd3b8d5d8062a91 — Filesystem access.
pkgs/python/[email protected]/src/pptx/text/fonts.py:200 
        return cls(open(path, "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytz

python dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #22eda0f1b2de5c86 — Environment-variable access.
pkgs/python/[email protected]/pytz/__init__.py:91 
    zoneinfo_dir = os.environ.get('PYTZ_TZDATADIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea86734b051634c2 — Filesystem access.
pkgs/python/[email protected]/pytz/__init__.py:118 
    return open(filename, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3daf035065b2484d — Environment-variable access.
pkgs/python/[email protected]/pytz/__init__.py:124 
        if os.environ.get('PYTZ_SKIPEXISTSCHECK', ''):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01b004c5cde3b84b — Filesystem access.
pkgs/python/[email protected]/pytz/tzfile.py:130 
                      open(os.path.join(base, 'Australia', 'Melbourne'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2716fa38c44a3bb2 — Filesystem access.
pkgs/python/[email protected]/pytz/tzfile.py:132 
                      open(os.path.join(base, 'US', 'Eastern'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e392b5afa12d69e — Filesystem access.
pkgs/python/[email protected]/setup.py:31 
    long_description=open('README.rst', 'r').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

requests

python dependency
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #ba4f470c38fec4af — Environment-variable access.
pkgs/python/[email protected]/src/requests/sessions.py:857 
                    os.environ.get("REQUESTS_CA_BUNDLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #372868e2c4aa2a6d — Environment-variable access.
pkgs/python/[email protected]/src/requests/sessions.py:858 
                    or os.environ.get("CURL_CA_BUNDLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95a6dd9f2817e8f6 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:239 
    netrc_file = os.environ.get("NETRC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ade9debee2c1e898 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:798 
        old_value = os.environ.get(env_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca2b9d42bac5fb71 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:799 
        os.environ[env_name] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cbae39370b31cdd — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:805 
                del os.environ[env_name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fafaf2d59f1de37f — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:807 
                os.environ[env_name] = old_value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #257853dc3ed5ac44 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:820 
        return os.environ.get(key) or os.environ.get(key.upper())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sentence-transformers

python dependency
expand_more 58 low-confidence finding(s)
low env_fs dependency Excluded from app score #d3bf8c4e250ea612 — Environment-variable access.
pkgs/python/[email protected]/sentence_transformers/__init__.py:45 
if importlib.util.find_spec("codecarbon") and "CODECARBON_LOG_LEVEL" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c51be19aef1c6294 — Environment-variable access.
pkgs/python/[email protected]/sentence_transformers/__init__.py:46 
    os.environ["CODECARBON_LOG_LEVEL"] = "error"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a0c191b70c36806 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/backend/load.py:155 
            with open(ov_config, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b611ad794e2a16b — Environment-variable access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:178 
            cache_folder = os.getenv("SENTENCE_TRANSFORMERS_HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f787bf86689f803a — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:625 
        with open(os.path.join(path, "config_sentence_transformers.json"), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98a4af046a815c71 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:670 
        with open(os.path.join(path, "modules.json"), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e43e51102b9fed94 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:762 
        with open(os.path.join(path, "README.md"), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8a87847df7af1f6 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:1067 
            with open(config_sentence_transformers_json_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc33e31b362af29e — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:1101 
                with open(model_card_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dc9390e4e7b1936 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:1115 
        with open(modules_json_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #375b0bbe5098d78e — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/model.py:1309 
        with open(config_sentence_transformers_json_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b91c608d1c57f376 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/modules/module.py:211 
        with open(config_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52f80934e39e0230 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/modules/module.py:406 
        with open(config_output_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09b7cfebe86fe131 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/modules/router.py:567 
        with open(os.path.join(output_path, self.config_file_name), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2958f92e7c026641 — Environment-variable access.
pkgs/python/[email protected]/sentence_transformers/base/trainer.py:295 
            os.environ.setdefault("WANDB_PROJECT", "sentence-transformers")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40cdef65df9a2218 — Environment-variable access.
pkgs/python/[email protected]/sentence_transformers/base/trainer.py:299 
            os.environ.setdefault("TRACKIO_PROJECT", "sentence-transformers")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c46f0d656bea36e — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/base/trainer.py:1037 
                with open(index_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d85bb492475ac87 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/classification.py:180 
            with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63f8c347d6075a60 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/correlation.py:129 
            with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ff98d16a9e1d6b1 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/nano_beir.py:283 
                fOut = open(csv_path, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64fdca036d01d181 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/nano_beir.py:288 
                fOut = open(csv_path, mode="a", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6edad574ee9153c7 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/reranking.py:301 
            with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d772f67f0fd83d5 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/datasets/parallel_sentences.py:96 
            else open(filepath, encoding="utf8") as fIn

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b78fac2dae8afde0 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/binary_classification.py:195 
                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #253bb03c8b3c1e95 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/binary_classification.py:200 
                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82eaea07bda2ee35 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/embedding_similarity.py:207 
            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95834f28dceecc57 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/information_retrieval.py:250 
                fOut = open(csv_path, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41d85c46a99ba9e9 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/information_retrieval.py:255 
                fOut = open(csv_path, mode="a", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88eb751bff173cdd — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/information_retrieval.py:388 
                with open(json_path, mode=mode, encoding="utf-8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b2cb90865783585 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/label_accuracy.py:84 
                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca8f4379e91d4ac3 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/label_accuracy.py:89 
                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d02ab4ee3cd70fd — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/mse.py:122 
            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fed4687132d11235 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/mse_from_dataframe.py:110 
            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e207cc12bd14136 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/nano_beir.py:353 
                fOut = open(csv_path, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af85da52d5b78920 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/nano_beir.py:358 
                fOut = open(csv_path, mode="a", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5ea12ee88cbfec4 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/paraphrase_mining.py:224 
                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cce647ab637f6a6 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/paraphrase_mining.py:229 
                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef46e6e70e9a829d — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/reranking.py:186 
            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #560907044d169c77 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/translation.py:157 
            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a0e18b071dab4d0 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/triplet.py:220 
                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b34c362e39aa48f8 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/triplet.py:226 
                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c5a0f078eab526e — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/phrase.py:105 
        with open(os.path.join(output_path, "phrasetokenizer_config.json"), "w") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efc20335529089ee — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/phrase.py:119 
        with open(os.path.join(input_path, "phrasetokenizer_config.json")) as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf37d75830e40e2f — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/whitespace.py:63 
        with open(os.path.join(output_path, "whitespacetokenizer_config.json"), "w") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96c5ce26844eb9f1 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/whitespace.py:75 
        with open(os.path.join(input_path, "whitespacetokenizer_config.json")) as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12ed8da543c4164a — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/word_embeddings.py:162 
            else open(embeddings_file_path, encoding="utf8") as fIn

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c4f55df4c3ec2c4 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/label_sentence.py:35 
        for line in open(os.path.join(self.folder, filename), encoding="utf-8"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1764c1e4ac09dc09 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/paired_files.py:30 
                else open(filepath, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fe5c7756bf27bdd — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/sts_data.py:54 
            else open(filepath, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dff3e60e40a5250 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/triplet.py:44 
            open(os.path.join(self.dataset_folder, filename), encoding="utf-8"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #911f5e4cff0aa566 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sparse_encoder/evaluation/reciprocal_rank_fusion.py:287 
                with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6dff8586ea6a60a2 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sparse_encoder/evaluation/reciprocal_rank_fusion.py:311 
                with open(json_path, mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8d90000410d3188 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/sparse_encoder/modules/sparse_static_embedding.py:143 
        with open(json_path) as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e5de71b46aa9f16 — Environment-variable access.
pkgs/python/[email protected]/sentence_transformers/util/environment.py:51 
        if "LOCAL_RANK" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5afc0fde8cbd4610 — Environment-variable access.
pkgs/python/[email protected]/sentence_transformers/util/environment.py:52 
            local_rank = int(os.environ["LOCAL_RANK"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5f41e34600bc158 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/util/file_io.py:243 
            with open(download_filepath, "wb") as file_binary:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #639d8c8c048717f4 — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/util/misc.py:182 
    with open(csv_path, newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #862805b66eae306e — Filesystem access.
pkgs/python/[email protected]/sentence_transformers/util/misc.py:191 
        with open(csv_path, "w", newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sqlalchemy

python dependency
expand_more 28 low-confidence finding(s)
low env_fs dependency Excluded from app score #273a6b64e76c67a9 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:42 
            with open(
                Path(cachedir) / "sqla_mypy_config.cfg", "w"
            ) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fdab380e365aee5 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:56 
            with open(
                Path(cachedir) / "plain_mypy_config.cfg", "w"
            ) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bfbc0fbba453c29 — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:106 
            os.environ.pop("MYPY_FORCE_COLOR", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0db50320a8692c40 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:146 
        with open(path) as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9389f44cf5b241d — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/plugin_base.py:398 
    if os.environ.get("REQUIRE_SQLALCHEMY_CEXT", "0") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d38ef2c8fbacebc9 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/plugin_base.py:455 
            with open(options.write_idents, "a") as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5da671af52eebaaa — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/pytestplugin.py:880 
        return os.environ.get("PYTEST_CURRENT_TEST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c6d4925b8b195aa — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/profiling.py:200 
            profile_f = open(self.fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3154c980edfbe6b5 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/profiling.py:219 
        profile_f = open(self.fname, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e7e42da27406bbb — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/provision.py:453 
    with open(idents_file) as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fe54f5fabd7a218 — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/util/_has_cy.py:27 
    if os.environ.get("DISABLE_SQLALCHEMY_CEXT_RUNTIME"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39da77ead1030385 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:134 
            Path(destination_path).write_text(
                text, encoding="utf-8", newline="\n"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8bbceb8a762e259 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:146 
            with open(tempfile) as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c4588d80c44a9f4 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:162 
            with open(source_file, encoding="utf-8") as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8279d5de120785a — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:169 
        with open(destination_path, encoding="utf-8") as dp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c243859759b419d1 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:95 
    cmd.extend(os.environ.get(dburl_env, default_dburl).split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #565218968c25814f — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:106 
    env_dbdrivers = os.environ.get(extra_driver_env, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ce84bfb57f074f9 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:269 
    cmd.extend(os.environ.get("TOX_WORKERS", "-n4").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52029dca8acb762b — Environment-variable access.
pkgs/python/[email protected]/setup.py:23 
DISABLE_EXTENSION = bool(os.environ.get("DISABLE_SQLALCHEMY_CEXT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3f93ee03d8c9da3 — Environment-variable access.
pkgs/python/[email protected]/setup.py:24 
REQUIRE_EXTENSION = bool(os.environ.get("REQUIRE_SQLALCHEMY_CEXT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #938ef2abbc799a8b — Filesystem access.
pkgs/python/[email protected]/tools/format_docs_code.py:155 
    original = file.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #36c7284c9ebc0c77 — Filesystem access.
pkgs/python/[email protected]/tools/format_docs_code.py:313 
                file.write_text(updated, "utf-8", newline="\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #37942c0dd3cc6239 — Filesystem access.
pkgs/python/[email protected]/tools/generate_proxy_methods.py:145 
    with open(fn.__code__.co_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bb9aa40c5cbb8ee1 — Filesystem access.
pkgs/python/[email protected]/tools/generate_proxy_methods.py:373 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cef0b8ca98d2078e — Filesystem access.
pkgs/python/[email protected]/tools/generate_sql_functions.py:38 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ef1c47763c081bb3 — Filesystem access.
pkgs/python/[email protected]/tools/generate_tuple_map_overloads.py:53 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c4c6dff70172a20a — Filesystem access.
pkgs/python/[email protected]/tools/normalize_file_headers.py:27 
    content = file.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ab9b69a7ff4fcdbb — Filesystem access.
pkgs/python/[email protected]/tools/sync_test_files.py:35 
    source_data = Path(source).read_text().replace(remove_str, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tiktoken

python dependency
expand_more 13 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #ccc037fb22aba461 — Environment-variable access.
pkgs/python/[email protected]/scripts/benchmark.py:16 
    num_threads = int(os.environ["RAYON_NUM_THREADS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b673892ff6639d48 — Filesystem access.
pkgs/python/[email protected]/scripts/redact.py:11 
    text = path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1307667fa5eaeb57 — Filesystem access.
pkgs/python/[email protected]/scripts/redact.py:35 
            path.write_text(redacted_text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b88e0aecc0ed9edc — Filesystem access.
pkgs/python/[email protected]/scripts/wheel_download.py:35 
        with open(temp_zip, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #642a9658683a216b — Filesystem access.
pkgs/python/[email protected]/tiktoken/_educational.py:212 
    with open(__file__) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4bd995aada8d5d5 — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:10 
        with open(blobpath, "rb", buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #880eb0952c12e9c2 — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:27 
    return blobfile.read_bytes(blobpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36c65040c6bad1c7 — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:37 
    if "TIKTOKEN_CACHE_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2c29757cbea6e51 — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:38 
        cache_dir = os.environ["TIKTOKEN_CACHE_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef23474921e3d5d5 — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:39 
    elif "DATA_GYM_CACHE_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9a93db1e88d722b — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:40 
        cache_dir = os.environ["DATA_GYM_CACHE_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f591d56d06a81be — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:55 
        with open(cache_path, "rb", buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40cd8dfe56e0bf31 — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:78 
        with open(tmp_filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

uvicorn

python dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #14bbd3cf6f202893 — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:335 
        if workers is None and "WEB_CONCURRENCY" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83b4c2ce84ced9e1 — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:336 
            self.workers = int(os.environ["WEB_CONCURRENCY"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e339dc5fca0e8af — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:340 
            self.forwarded_allow_ips = os.environ.get("FORWARDED_ALLOW_IPS", "127.0.0.1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2968a297f7762369 — Filesystem access.
pkgs/python/[email protected]/uvicorn/config.py:374 
                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dddf9e7f24b696d9 — Filesystem access.
pkgs/python/[email protected]/uvicorn/config.py:382 
                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @floating-ui/dom prod — dist-only: no readable source
  • @sveltejs/svelte-virtual-list prod — no javascript source
  • @xyflow/svelte prod — dist-only: no readable source
  • codemirror-lang-hcl prod — dist-only: no readable source
  • kokoro-js prod — tarball exceeds byte cap
  • langchain-community prod — sdist exceeds byte cap
  • Markdown prod — scan budget exceeded
  • beautifulsoup4 prod — scan budget exceeded
  • pypandoc prod — scan budget exceeded
  • pandas prod — scan budget exceeded
  • openpyxl prod — scan budget exceeded
  • pyxlsb prod — scan budget exceeded
  • xlrd prod — scan budget exceeded
  • validators prod — scan budget exceeded
  • psutil prod — scan budget exceeded
  • sentencepiece prod — scan budget exceeded
  • soundfile prod — scan budget exceeded
  • pillow prod — scan budget exceeded
  • opencv-python-headless prod — scan budget exceeded
  • rapidocr-onnxruntime prod — scan budget exceeded
  • rank-bm25 prod — scan budget exceeded
  • onnxruntime prod — scan budget exceeded
  • faster-whisper prod — scan budget exceeded
  • black prod — scan budget exceeded
  • youtube-transcript-api prod — scan budget exceeded
  • pytube prod — scan budget exceeded
  • pydub prod — scan budget exceeded
  • ddgs prod — scan budget exceeded
  • google-api-python-client prod — scan budget exceeded
  • google-auth-httplib2 prod — scan budget exceeded
  • google-auth-oauthlib prod — scan budget exceeded
  • googleapis-common-protos prod — scan budget exceeded
  • ldap3 prod — scan budget exceeded
  • psycopg2-binary prod — scan budget exceeded
  • pgvector prod — scan budget exceeded
  • mariadb prod — scan budget exceeded
  • unstructured prod — scan budget exceeded
  • pymongo prod — scan budget exceeded
  • moto prod — scan budget exceeded
  • gcp-storage-emulator prod — scan budget exceeded
  • docker prod — scan budget exceeded
  • pytest prod — scan budget exceeded
  • pytest-docker prod — scan budget exceeded
  • playwright prod — scan budget exceeded
  • elasticsearch prod — scan budget exceeded
  • qdrant-client prod — scan budget exceeded
  • weaviate-client prod — scan budget exceeded
  • pymilvus prod — scan budget exceeded
  • pinecone prod — scan budget exceeded
  • oracledb prod — scan budget exceeded
  • colbert-ai prod — scan budget exceeded