Close Open Privacy Scan

link https://github.com/GLips/Figma-Context-MCP
bolt Snapshot: commit c083d65
science engine v1.22
schedule 2026-07-21T08:07:31.287921+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy MCP server detected: @modelcontextprotocol/sdk — detected in dependencies, not a safety judgment.

App Privacy Score

77 /100
Medium privacy risk

Medium risk · 130 finding(s)

Dependency score: 57 (Medium risk)

bar_chart Score Breakdown

egress −10
telemetry −10
env_fs −3

list Scan Summary

0 high 5 medium 125 low
First-party packages: 1
Dependency packages: 9
Ecosystem: npm

swap_horiz External domains

api.figma.comdevelopers.figma.comgithub.comjson-schema.orgposthog.comsentry.ious.i.posthog.comwww.framelink.ai

</> First-Party Code

first-party (npm)

npm first-party
medium telemetry production #ec877570782ff456 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/telemetry/client.ts:3 
import { PostHog } from "posthog-node";

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 28 low-confidence finding(s)
low env_fs test-only Excluded from app score #ac0145cebae5b28d — Filesystem access.
repo/scripts/benchmark-simplify.ts:119 
  const rawJson = readFileSync(INPUT_PATH, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a747264a6481345c — Filesystem access.
repo/scripts/benchmark-simplify.ts:185 
    writeFileSync(profilePath, JSON.stringify(profile));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e6ef8458907c9e40 — Filesystem access.
repo/scripts/compare-formats.ts:17 
const design = JSON.parse(readFileSync(inputPath, "utf8")) as SimplifiedDesign;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #72e8a89cd0dc7a7b — Filesystem access.
repo/scripts/compare-formats.ts:26 
writeFileSync(resolve(outDir, `${stem}.yaml`), yamlOut);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d14197d8333b6768 — Filesystem access.
repo/scripts/compare-formats.ts:27 
writeFileSync(resolve(outDir, `${stem}.tree`), treeOut);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0b703b01ee219cae — Filesystem access.
repo/scripts/render-fixture.ts:37 
const design = JSON.parse(readFileSync(values.input, "utf8")) as SimplifiedDesign;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #919eb9f3087fae4d — Filesystem access.
repo/scripts/render-fixture.ts:39 
writeFileSync(values.output, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3ad41299d476ffad — Filesystem access.
repo/scripts/scan-hidden-chars.mjs:91 
    content = readFileSync(filepath, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dda277502c924944 — Environment-variable access.
repo/src/bin.ts:10 
  version: process.env.NPM_PACKAGE_VERSION ?? "unknown",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #73d0b3f9ce9bfe8e — Environment-variable access.
repo/src/bin.ts:80 
  const isStdio = argv.flags.stdio === true || process.env.NODE_ENV === "cli";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eb19f56172b04d13 — Environment-variable access.
repo/src/config.ts:50 
  return process.env[name] || undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6466bba1b56c3b0 — Environment-variable access.
repo/src/config.ts:55 
    const val = process.env[name];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d2edcf9dacdd1e64 — Environment-variable access.
repo/src/config.ts:62 
  const val = process.env[name];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e1f11d98b15f96a — Environment-variable access.
repo/src/config.ts:182 
      : process.env.FRAMELINK_TELEMETRY !== undefined || process.env.DO_NOT_TRACK !== undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a89f98fef9e8537 — Environment-variable access.
repo/src/mcp/index.ts:17 
  version: process.env.NPM_PACKAGE_VERSION ?? "unknown",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9ecd0c454544425 — Environment-variable access.
repo/src/telemetry/client.ts:83 
  if (process.env.FRAMELINK_TELEMETRY === "off") return false;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4df35cf3336d0247 — Environment-variable access.
repo/src/telemetry/client.ts:84 
  const doNotTrack = process.env.DO_NOT_TRACK;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ae0cc98f046cb06c — Environment-variable access.
repo/src/telemetry/client.ts:106 
    server_version: process.env.NPM_PACKAGE_VERSION ?? "unknown",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #62f044d068ea456f — Environment-variable access.
repo/src/telemetry/client.ts:109 
    is_ci: Boolean(process.env.CI),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8f799e148e9d77b6 — Filesystem access.
repo/src/utils/common.ts:1 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #1aa4dc4786cbd86d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/utils/common.ts:33 
    const response = await fetch(imageUrl, {
      method: "GET",
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #7a16541cb16ebdb9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/utils/fetch-json.ts:65 
    const response = await fetch(url, fetchOptions);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #70b3503679c953fb — Filesystem access.
repo/src/utils/logger.ts:1 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97bf8c3c361cc1f3 — Environment-variable access.
repo/src/utils/logger.ts:21 
  if (process.env.NODE_ENV !== "development") return;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #20bfb8e514568d42 — Filesystem access.
repo/src/utils/logger.ts:35 
    fs.writeFileSync(logPath, JSON.stringify(value, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e66e78e8d8f87f27 — Environment-variable access.
repo/src/utils/proxy-env.ts:17 
  return PROXY_ENV_VARS.some((n) => process.env[n] || process.env[n.toLowerCase()]);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #65c8aedbb9fa3ea9 — Environment-variable access.
repo/tsup.config.ts:3 
const isDev = process.env.npm_lifecycle_event === "dev";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ed35616182a260b6 — Environment-variable access.
repo/tsup.config.ts:4 
const packageVersion = process.env.npm_package_version;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

posthog-node

npm dependency
medium telemetry dependency Excluded from app score #3be50bc70d72b0af — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:69 
    posthog.withContext(buildRequestContextData(posthog, req), () => next())

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ebfd47aa98515250 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:98 
    posthog.addPendingPromise(
      ErrorTracking.buildEventMessage(
        posthog.getErrorPropertiesBuilder(),
        error,
        hint,
        contextData.distinctId,
        additionalProperties
      ).then((msg) => {
        return posthog._capturePreparedEvent(msg, false)
      })
    )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7100478e14f97c14 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:100 
        posthog.getErrorPropertiesBuilder(),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #56a710ea4eadddea — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:106 
        return posthog._capturePreparedEvent(msg, false)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 2 low-confidence finding(s)
low egress dependency Excluded from app score #333d6ed875c861fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/client.ts:420 
    return this.options.fetch ? this.options.fetch(url, options) : fetch(url, options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6ef3891cfb62cd8e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/extensions/feature-flags/feature-flags.ts:1020 
      return fetch(url, options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@jimp/core

npm dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #5f6185337fb7cf51 — Filesystem access.
pkgs/npm/@[email protected]/src/index.ts:243 
        return this.fromBuffer(await readFile(url));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #30fe1bfad767751d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/index.ts:246 
      const [fetchErr, response] = await to(fetch(url));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #f504d1cd3bc4c3d2 — Filesystem access.
pkgs/npm/@[email protected]/src/index.ts:509 
      await writeFile(
        path,
        await this.getBuffer(mimeType as SupportedMimeTypes, options)
      );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@modelcontextprotocol/sdk

npm dependency
expand_more 38 low-confidence finding(s)
low egress tooling Excluded from app score unknown #4aee176cd526bf6b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/scripts/cli.ts:54 
    await client.request({ method: 'resources/list' }, ListResourcesResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #82c44223ee5f3c4c — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:16 
    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #ae81362c48ae6c79 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:32 
    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #bc727b38e1ab9402 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:77 
        writeFileSync(outputPath, fullContent, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c85775532936547f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/client/stdio.ts:71 
        const value = process.env[key];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #9de14b5e14ac1ac7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:632 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #ffd7bd0eb114651b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:663 
        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #4a5703907c54ba76 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/multipleClientsParallel.ts:64 
        const result = await client.request(toolRequest, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #c706dc5c35ba3684 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:95 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #15d51d6ccb813c69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:167 
            return client
                .request(request, CallToolResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #52ecca6dd23aaa89 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:26 
const DEFAULT_SERVER_URL = process.env.MCP_SERVER_URL || 'http://localhost:3000/mcp';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #483fd73bc96288ff — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:29 
    const clientId = process.env.MCP_CLIENT_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5dfbc38b210307b1 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:36 
    const privateKeyPem = process.env.MCP_CLIENT_PRIVATE_KEY_PEM;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0dd917e09c54df77 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:38 
        const algorithm = process.env.MCP_CLIENT_ALGORITHM || 'RS256';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6384f48d06641876 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:48 
    const clientSecret = process.env.MCP_CLIENT_SECRET;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #dd115e719e00dde1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:232 
            const result = await this.client.request(request, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #10d7b3341b8d2f19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:290 
            const result = await this.client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #95a5dcf48bf36faf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:510 
                const resourcesResult = await client.request(
                    {
                        method: 'resources/list',
                        params: {}
                    },
                    ListResourcesResultSchema
                );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #79af60992caade23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:601 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #d4088dba1413677e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:632 
        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #ebca2eaba55693f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:719 
        const result = await client.request(request, CallToolResultSchema, {
            resumptionToken: notificationsToolLastEventId,
            onresumptiontoken: onLastEventIdUpdate
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #f3c477134e5e0b6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:748 
        const promptsResult = await client.request(promptsRequest, ListPromptsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #159fdff30ab258a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:777 
        const promptResult = await client.request(promptRequest, GetPromptResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #2e2b990cb7cb4291 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:798 
        const resourcesResult = await client.request(resourcesRequest, ListResourcesResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #e6045607772ea897 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:826 
        const result = await client.request(request, ReadResourceResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #37320369717675e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/ssePollingClient.ts:75 
        const result = await client.request(
            {
                method: 'tools/call',
                params: {
                    name: 'long-task',
                    arguments: {}
                }
            },
            CallToolResultSchema,
            {
                // Track resumption tokens for debugging
                onresumptiontoken: token => {
                    lastEventId = token;
                    console.log(`[Event ID] ${token}`);
                }
            }
        );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #69cd860d58ad490b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:139 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #388fb2046c3a593f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:172 
        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #a2e66c3fdaa07e70 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationFormExample.ts:350 
    const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8efad08204aa2176 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:215 
const MCP_PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c9fc4c7823197267 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:216 
const AUTH_PORT = process.env.MCP_AUTH_PORT ? parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #da122c340244cdfe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:245 
        const response = await fetch(endpoint, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded'
            },
            body: new URLSearchParams({
                token: token
            }).toString()
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #1a8fa643a70a2c5d — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/honoWebStandardStreamableHttp.ts:69 
const PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #aedefe87ff9f34da — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:621 
const MCP_PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #145ee39b20532648 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:622 
const AUTH_PORT = process.env.MCP_AUTH_PORT ? parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #78d1cfabb332cc85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:643 
            const response = await fetch(endpoint, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/x-www-form-urlencoded'
                },
                body: new URLSearchParams({
                    token: token
                }).toString()
            });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #79b3d387b013ad03 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleTaskInteractive.ts:448 
const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 8000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68af277f9f819a05 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/server/auth/router.ts:12 
    process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === 'true' || process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === '1';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cross-env

npm dependency
expand_more 15 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #aaa6607bc1cde59c — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/index.test.ts:230 
	} else if (!process.env.APPDATA && expected.APPDATA === '0') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #81289c54859048d2 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/index.test.ts:232 
		process.env.APPDATA = '0'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4e4c830a6c623db4 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/index.test.ts:236 
	if (process.env.APPDATA) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #32d12bf137e68321 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/index.test.ts:237 
		env.APPDATA = process.env.APPDATA

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7e6e4a90c643beb5 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/is-windows.test.ts:9 
	process.env.OSTYPE = OSTYPE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #bbc4790b9551b21b — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/is-windows.test.ts:26 
		process.env.OSTYPE = 'cygwin'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4fa7be7f679e8330 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/is-windows.test.ts:29 
		process.env.OSTYPE = 'msys'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c74913b11109ea77 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/is-windows.test.ts:32 
		process.env.OSTYPE = ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f47c962e8465e3a8 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/variable.test.ts:10 
	process.env.VAR1 = 'value1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f10c27e7b028f433 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/variable.test.ts:11 
	process.env.VAR2 = 'value2'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #70e8756a16a3b21f — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/__tests__/variable.test.ts:12 
	process.env.JSON_VAR = JSON_VALUE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44f85d4d8db32b0c — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/index.ts:113 
	if (process.env.APPDATA) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4615ce6ecddbc55 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/index.ts:114 
		envVars.APPDATA = process.env.APPDATA

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #778e56dfc5702f94 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/is-windows.ts:8 
		/^(msys|cygwin)$/.test(process.env.OSTYPE || '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9664c4e114acefef — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/variable.ts:53 
				(process.env[varName || altVarName] || '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

dotenv

npm dependency
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #da4b086e9045a3f0 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:4 
if (process.env.DOTENV_CONFIG_ENCODING != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26ccad8c6195613c — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:5 
  options.encoding = process.env.DOTENV_CONFIG_ENCODING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcf7e773353a3920 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:8 
if (process.env.DOTENV_CONFIG_PATH != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f60de344a0ea406 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:9 
  options.path = process.env.DOTENV_CONFIG_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3228b8424f6aa5b — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:12 
if (process.env.DOTENV_CONFIG_QUIET != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #706b99f4204c8525 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:13 
  options.quiet = process.env.DOTENV_CONFIG_QUIET

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7241bb50c2854f04 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:16 
if (process.env.DOTENV_CONFIG_DEBUG != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #780123ba6774896e — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:17 
  options.debug = process.env.DOTENV_CONFIG_DEBUG

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f27b5ec3b20a29ba — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:20 
if (process.env.DOTENV_CONFIG_OVERRIDE != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8543c198070f696 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:21 
  options.override = process.env.DOTENV_CONFIG_OVERRIDE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88b6f9b34b614e7f — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:24 
if (process.env.DOTENV_CONFIG_DOTENV_KEY != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fef65b739e79d63 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:25 
  options.DOTENV_KEY = process.env.DOTENV_CONFIG_DOTENV_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66025b729e9a9022 — Filesystem access.
pkgs/npm/[email protected]/lib/main.js:1 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a325c45294c8a32 — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:141 
  if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cb5ec2286fc6dd9 — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:142 
    return process.env.DOTENV_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #506d763071d2b10a — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:221 
  const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || (options && options.debug))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d91dc848d9623b58 — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:222 
  const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || (options && options.quiet))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab42e5f57e0c7145 — Filesystem access.
pkgs/npm/[email protected]/lib/main.js:277 
      const parsed = DotenvModule.parse(fs.readFileSync(path, { encoding }))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

express

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #31eecf2dddc101c4 — Environment-variable access.
pkgs/npm/[email protected]/lib/application.js:91 
  var env = process.env.NODE_ENV || 'development';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

js-yaml

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #4dc337165e8466c8 — Filesystem access.
pkgs/npm/[email protected]/bin/js-yaml.mjs:7 
const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c83407673ece0095 — Filesystem access.
pkgs/npm/[email protected]/bin/js-yaml.mjs:60 
  input = readFileSync(options.file === '-' ? 0 : options.file, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

remeda

npm dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #de43dae34f4cce98 — Filesystem access.
pkgs/npm/[email protected]__reposrc/.claude/hooks/post-edit-prettier.ts:34 
    const beforePrettier = readFileSync(filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #950929d69efe343a — Filesystem access.
pkgs/npm/[email protected]__reposrc/.claude/hooks/post-edit-prettier.ts:45 
    writeFileSync(filePath, afterPrettier);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1730612dc49ea88 — Filesystem access.
pkgs/npm/[email protected]__reposrc/packages/remeda/tsdown.config.ts:153 
        const content = await readFile(file, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e900caf477e66a6 — Filesystem access.
pkgs/npm/[email protected]__reposrc/packages/remeda/tsdown.config.ts:173 
        await writeFile(file, withSymbols);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #454437a816bcf40b — Filesystem access.
pkgs/npm/[email protected]__reposrc/packages/remeda/tsdown.config.ts:193 
    const content = await readFile(file, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

undici

npm dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #4cf88a6f2b6388fc — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:68 
  const llhttpWasmData = process.env.JEST_WORKER_ID ? require('../llhttp/llhttp-wasm.js') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f588903015f4a68c — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:75 
  if (process.env.UNDICI_NO_WASM_SIMD === '1') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c76f043bf8313eb6 — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:77 
  } else if (process.env.UNDICI_NO_WASM_SIMD === '0') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #b94f655af87e11b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/lib/dispatcher/client-h2.js:851 
    return session.request(headers, options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #7f57f1a6a464948c — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:26 
    const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aba159dfa67e7c5d — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:33 
    const HTTPS_PROXY = httpsProxy ?? process.env.https_proxy ?? process.env.HTTPS_PROXY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #940be99ba09a8eca — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:142 
    return process.env.no_proxy ?? process.env.NO_PROXY ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3bb14c1d148c70c — Environment-variable access.
pkgs/npm/[email protected]/lib/mock/pending-interceptors-formatter.js:23 
        colors: !disableColors && !process.env.CI

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6751c34df89052d — Filesystem access.
pkgs/npm/[email protected]/lib/mock/snapshot-recorder.js:424 
      const data = await readFile(resolve(path), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #193ce2dc59ac8cac — Filesystem access.
pkgs/npm/[email protected]/lib/mock/snapshot-recorder.js:470 
    await writeFile(resolvedPath, JSON.stringify(data, null, 2), { flush: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f21385250181440b — Filesystem access.
pkgs/npm/[email protected]/scripts/strip-comments.js:7 
  ? transcode(readFileSync('./undici-fetch.js'), 'utf8', 'latin1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #92f513189cf74ab8 — Filesystem access.
pkgs/npm/[email protected]/scripts/strip-comments.js:8 
  : readFileSync('./undici-fetch.js')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f79cfe5bcbf95e20 — Filesystem access.
pkgs/npm/[email protected]/scripts/strip-comments.js:10 
writeFileSync('./undici-fetch.js', buffer.toString('latin1'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @figma/rest-api-spec prod — dist-only: no readable source