Close Open Privacy Scan

link https://github.com/kunchenguid/no-mistakes
bolt Snapshot: commit 0e07573
science engine v1
schedule 2026-06-25T09:47:22.016784+00:00

verified_user Possible application data leak

Potential data exfiltration identified in application code.

App Privacy Score

67 /100
Medium privacy risk — possible application leak

Medium risk · 184 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

pii_flow −30
env_fs −3

list Scan Summary

0 high 2 medium 182 low
First-party packages: 1
Dependency packages: 4
Ecosystem: go

swap_horiz Potential data exfiltration in application code

External domains: github.com

medium first-party (go) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
repo/cmd/fakeagent/main.go:94 → repo/cmd/fakeagent/main.go:99
medium first-party (go) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
repo/internal/daemon/daemon.go:91 → repo/internal/daemon/daemon.go:96

</> First-Party Code

first-party (go)

go first-party
medium pii_flow production #b3da6108bebc49e7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
repo/cmd/fakeagent/main.go:99 · flow /tmp/closeopen-ink85jyt/repo/cmd/fakeagent/main.go:94 → /tmp/closeopen-ink85jyt/repo/cmd/fakeagent/main.go:99 
		fmt.Printf("https://github.com/%s/pull/99\n", strings.TrimSuffix(repo, ".git"))

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
medium pii_flow production #9a5f82b76fc9b76a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
repo/internal/daemon/daemon.go:96 · flow /tmp/closeopen-ink85jyt/repo/internal/daemon/daemon.go:91 → /tmp/closeopen-ink85jyt/repo/internal/daemon/daemon.go:96 
	slog.Info("daemon environment ready",
		"path_entries", entries,
		"path", path,
	)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 101 low-confidence finding(s)
low env_fs production #2d9f70dafaed05a8 — Filesystem access.
repo/cmd/fakeagent/codex.go:154 
	data, err := os.ReadFile(schemaPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ebeb81b85449552d — Environment-variable access.
repo/cmd/fakeagent/fixture.go:15 
	root := os.Getenv("FAKEAGENT_FIXTURE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #38031fedfb139ce4 — Filesystem access.
repo/cmd/fakeagent/fixture.go:37 
		data, err := os.ReadFile(p)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39e4aec3f85adbba — Environment-variable access.
repo/cmd/fakeagent/log.go:25 
	path := os.Getenv("FAKEAGENT_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #295fdf58c206797a — Filesystem access.
repo/cmd/fakeagent/log.go:43 
	f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2968f90ce20deea1 — Environment-variable access.
repo/cmd/fakeagent/main.go:31 
	scenario, err := loadScenario(os.Getenv("FAKEAGENT_SCENARIO"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1eff92d04b38d8de — Environment-variable access.
repo/cmd/fakeagent/main.go:57 
	if os.Getenv("FAKEAGENT_GH_MODE") == "fork-pr" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #33393cb23f52911c — Environment-variable access.
repo/cmd/fakeagent/main.go:94 
			repo = os.Getenv("FAKEAGENT_GH_PARENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b3de6f39c204cb7 — Environment-variable access.
repo/cmd/fakeagent/main.go:122 
	logPath := os.Getenv("FAKEAGENT_GH_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #104fb5aa1221c5b9 — Filesystem access.
repo/cmd/fakeagent/main.go:126 
	f, err := os.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e1cf5842c15c9c1f — Filesystem access.
repo/cmd/fakeagent/opencode.go:103 
		return os.ReadFile(fmt.Sprintf("%s/%s/%s", dir, flavour, name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8c4bfcfd1dfc50c8 — Filesystem access.
repo/cmd/fakeagent/scenario.go:69 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d4d691c2f325b108 — Filesystem access.
repo/cmd/fakeagent/scenario.go:167 
			if err := os.WriteFile(path, []byte(e.New), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #48dfe68fd1b1cbc5 — Filesystem access.
repo/cmd/fakeagent/scenario.go:174 
		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f35f0600ace3dec4 — Filesystem access.
repo/cmd/fakeagent/scenario.go:188 
		if err := os.WriteFile(path, []byte(updated), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #02de9e34293faa40 — Filesystem access.
repo/cmd/genskill/main.go:34 
		got, err := os.ReadFile(rel)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd65c644115a0ca9 — Filesystem access.
repo/cmd/genskill/main.go:51 
	if err := os.WriteFile(rel, []byte(want), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b33c299503aa3b84 — Environment-variable access.
repo/cmd/no-mistakes/main.go:65 
	if os.Getenv("NM_DAEMON") == "1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #062387a086eb9187 — Filesystem access.
repo/cmd/no-mistakes/main.go:100 
	f, err := os.OpenFile(p.CLILog(), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3da9871be5926fd2 — Filesystem access.
repo/cmd/recordfixture/claude.go:70 
	f, err := os.Create(outPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cd8080a81dc34970 — Filesystem access.
repo/cmd/recordfixture/codex.go:59 
	f, err := os.Create(outPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af73c22124830372 — Filesystem access.
repo/cmd/recordfixture/opencode.go:123 
	if err := os.WriteFile(filepath.Join(dir, "session.json"), sessionRaw, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64f17f9780b23ae8 — Filesystem access.
repo/cmd/recordfixture/opencode.go:171 
	if err := os.WriteFile(filepath.Join(dir, "message.json"), msgRaw, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8cdc9e577fb3b11a — Filesystem access.
repo/cmd/recordfixture/opencode.go:186 
	if err := os.WriteFile(filepath.Join(dir, "sse.txt"), sseCapture.Bytes(), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eae26c5f2787e007 — Filesystem access.
repo/cmd/recordfixture/scrub.go:21 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eda9d8ab9deb5db2 — Filesystem access.
repo/cmd/recordfixture/scrub.go:29 
	return os.WriteFile(path, scrubbed, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c01761ea468c9620 — Environment-variable access.
repo/internal/bitbucket/client.go:420 
	if value, ok := os.LookupEnv(key); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #483d780d0c5793b4 — Filesystem access.
repo/internal/cli/axi_drive.go:353 
		data, err := os.ReadFile(filepath.Join(p.RunLogDir(runID), string(types.StepCI)+".log"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f8b71311008d7171 — Filesystem access.
repo/internal/cli/axi_query.go:146 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #44cc13a864e4bd4a — Filesystem access.
repo/internal/cli/wizard.go:297 
	f, err := os.OpenFile(logPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e7fa8eef2d3f627f — Filesystem access.
repo/internal/config/config.go:452 
	if wErr := os.WriteFile(path, []byte(defaultConfigYAML), 0o644); wErr != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a5f5f0731c9cce17 — Filesystem access.
repo/internal/config/config.go:465 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #02106aafdf4eec40 — Filesystem access.
repo/internal/config/config.go:547 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f298c8be0dbf766b — Environment-variable access.
repo/internal/daemon/daemon.go:61 
	nmHome := os.Getenv("NM_HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cc415e3c90f59655 — Environment-variable access.
repo/internal/daemon/daemon.go:91 
	path := os.Getenv("PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #abacc9e210ef9607 — Filesystem access.
repo/internal/daemon/daemon.go:161 
		if pidData, err := os.ReadFile(pidPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4f77d6ddc967446 — Filesystem access.
repo/internal/daemon/daemon.go:190 
	if pidData, err := os.ReadFile(pidPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ce5e9d7714a14fec — Environment-variable access.
repo/internal/daemon/proc_unix.go:51 
	env := upsertEnv(os.Environ(), "LC_ALL", "C")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8aad9e1c643cd656 — Environment-variable access.
repo/internal/daemon/proc_unix.go:78 
	env := upsertEnv(os.Environ(), "LC_ALL", "C")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #56298f8fceaf5623 — Filesystem access.
repo/internal/daemon/recover_servers.go:137 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c904dc1d7ef10760 — Filesystem access.
repo/internal/daemon/recover_servers.go:195 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f9af4d992de7e2bc — Environment-variable access.
repo/internal/daemon/selfexec.go:37 
	value := os.Getenv(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9a9cf1c273737079 — Filesystem access.
repo/internal/daemon/selfexec.go:117 
	existing, readErr := os.ReadFile(installPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #95fe56dffb9fecca — Filesystem access.
repo/internal/daemon/selfexec.go:150 
		if err := os.WriteFile(installPath, existing, restoreMode); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23e40050c265d896 — Filesystem access.
repo/internal/daemon/selfexec.go:225 
	logFile, err := os.OpenFile(p.DaemonLog(), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cf92cdbc11823302 — Environment-variable access.
repo/internal/daemon/selfexec.go:232 
	cmd.Env = upsertEnv(os.Environ(), "NM_HOME", p.Root())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e40a9f800bc9de3 — Environment-variable access.
repo/internal/daemon/service.go:58 
	if os.Getenv("NM_TEST_START_DAEMON") == "1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #29c08c7673368a1d — Filesystem access.
repo/internal/daemon/service_launchd.go:36 
	if err := os.WriteFile(path, []byte(renderLaunchAgent(exe, p, home)), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5aa91df7c802426c — Filesystem access.
repo/internal/daemon/service_launchd.go:51 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b3d324235b2fad3d — Filesystem access.
repo/internal/daemon/service_systemd.go:22 
	if err := os.WriteFile(path, []byte(renderSystemdUnit(exe, p, home)), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab4e68caab432fc7 — Filesystem access.
repo/internal/daemon/service_systemd.go:37 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #60a5b4ecf63c1dfc — Environment-variable access.
repo/internal/e2e/harness.go:126 
	t.Setenv("PATH", h.BinDir+string(os.PathListSeparator)+os.Getenv("PATH"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5823ec23ed3f1461 — Filesystem access.
repo/internal/e2e/harness.go:186 
	if err := os.WriteFile(configPath, []byte(cfg), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f671fca801a3367d — Filesystem access.
repo/internal/e2e/harness.go:220 
	if err := os.WriteFile(readme, []byte("# e2e\n"), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a70df7f6d08f8c5e — Filesystem access.
repo/internal/e2e/harness.go:234 
	if err := os.WriteFile(repoConfig, []byte(repoCfg), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc11d210031b928c — Environment-variable access.
repo/internal/e2e/harness.go:263 
	cmd.Env = mergedEnv(os.Environ(), env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e7385dcd954c3373 — Filesystem access.
repo/internal/e2e/harness.go:318 
	if err := os.WriteFile(full, []byte(content), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f768c407b7594689 — Filesystem access.
repo/internal/e2e/harness.go:573 
		if data, err := os.ReadFile(candidate); err == nil && len(data) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f18da8681a0ae8c5 — Filesystem access.
repo/internal/e2e/harness.go:577 
	if data, err := os.ReadFile(h.AgentLog); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e36af523b97bc02f — Filesystem access.
repo/internal/e2e/harness.go:585 
		if data, err := os.ReadFile(path); err == nil && len(data) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #68dbfd14d751260b — Filesystem access.
repo/internal/e2e/harness.go:604 
	data, err := os.ReadFile(h.AgentLog)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef97b6b3b98017da — Environment-variable access.
repo/internal/e2e/harness.go:638 
	cmd.Env = append(os.Environ(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40e860dee4aadc54 — Environment-variable access.
repo/internal/e2e/harness.go:672 
	cmd.Env = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #26379ecf0ea41922 — Environment-variable access.
repo/internal/git/env.go:28 
	env := append(os.Environ(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f25a03a1263cd51e — Filesystem access.
repo/internal/git/hook.go:113 
	existing, err := os.ReadFile(hookPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a39b97762f78972 — Filesystem access.
repo/internal/intent/disambiguator.go:279 
	if err := os.WriteFile(path, data, 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #165a043ed198d438 — Filesystem access.
repo/internal/intent/reader_claude.go:106 
	f, err := os.Open(s.startedAtPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65ab8fffb9c52c48 — Filesystem access.
repo/internal/intent/reader_claude.go:151 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9f561c220b7dd905 — Filesystem access.
repo/internal/intent/reader_codex.go:111 
	f, err := os.Open(s.startedAtPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e1558a9b2967f259 — Environment-variable access.
repo/internal/intent/reader_opencode.go:210 
	if xdg := os.Getenv("XDG_DATA_HOME"); xdg != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #063d527d8c407430 — Filesystem access.
repo/internal/intent/reader_pi.go:104 
	f, err := os.Open(s.startedAtPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4fc7f0c9370af5b0 — Filesystem access.
repo/internal/intent/reader_pi.go:176 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #248278e03f68393a — Filesystem access.
repo/internal/intent/reader_rovodev.go:86 
	data, err := os.ReadFile(ctxPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6d01b84f8dd54a9 — Filesystem access.
repo/internal/intent/reader_rovodev.go:127 
	if data, err := os.ReadFile(filepath.Join(sessionDir, "metadata.json")); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79759b86c4643593 — Filesystem access.
repo/internal/intent/reader_rovodev.go:139 
	if data, err := os.ReadFile(filepath.Join(sessionDir, "session_context.json")); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #30e329fcfe96b723 — Filesystem access.
repo/internal/ipc/transport_windows.go:35 
	if err := os.WriteFile(tmpFile, []byte(content), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab4aa27933306afc — Filesystem access.
repo/internal/ipc/transport_windows.go:59 
	data, err := os.ReadFile(endpoint)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19201d8984cc7f88 — Environment-variable access.
repo/internal/paths/paths.go:17 
	if env := os.Getenv("NM_HOME"); env != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b7a760b4bb9c83c — Filesystem access.
repo/internal/pipeline/executor.go:197 
	logFile, err := os.OpenFile(logPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #605fcd1db2adb352 — Environment-variable access.
repo/internal/pipeline/steps/common_exec.go:50 
	merged := make([]string, 0, len(os.Environ())+len(extra))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #531e8045f1ab0501 — Environment-variable access.
repo/internal/pipeline/steps/common_exec.go:55 
	for _, entry := range os.Environ() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ba81067e9f41bea2 — Filesystem access.
repo/internal/pipeline/steps/common_fs.go:46 
	src, err := os.Open(srcPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c559b57c786dbf3 — Filesystem access.
repo/internal/pipeline/steps/common_fs.go:52 
	dst, err := os.OpenFile(dstPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, perm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45e7221ddcaebcfe — Environment-variable access.
repo/internal/pipeline/steps/demo.go:33 
	return os.Getenv("NM_DEMO") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fefd05543e173328 — Filesystem access.
repo/internal/pipeline/steps/prsummary.go:503 
		data, err := os.ReadFile(fsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3955203b9c6aa3e8 — Filesystem access.
repo/internal/pipeline/steps/prsummary.go:510 
	file, err := os.Open(fsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #87d9537b9795a5df — Environment-variable access.
repo/internal/shellenv/shellenv.go:105 
		return append([]string(nil), os.Environ()...), true

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa130d41f0558079 — Environment-variable access.
repo/internal/shellenv/shellenv.go:117 
		fallback := append([]string(nil), os.Environ()...)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #91a57261b9b35ba5 — Environment-variable access.
repo/internal/shellenv/shellenv.go:124 
		fallback := append([]string(nil), os.Environ()...)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4ed9f74eb48eabd — Filesystem access.
repo/internal/skill/install.go:56 
		if err := os.WriteFile(filepath.Join(realDir, "SKILL.md"), content, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c79ec2c228b0a492 — Environment-variable access.
repo/internal/telemetry/telemetry.go:353 
	websiteID := strings.TrimSpace(os.Getenv(umamiWebsiteIDEnv))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2a575f2a1b11aa9 — Environment-variable access.
repo/internal/telemetry/telemetry.go:368 
	host := strings.TrimSpace(os.Getenv(umamiHostEnv))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cdaeae74a23367bc — Environment-variable access.
repo/internal/telemetry/telemetry.go:386 
	switch strings.ToLower(strings.TrimSpace(os.Getenv(telemetryEnv))) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ddc3b562ba49ebd4 — Filesystem access.
repo/internal/telemetry/telemetry.go:405 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7ed6b84eb303cede — Filesystem access.
repo/internal/update/background.go:14 
	devNull, err := os.OpenFile(os.DevNull, os.O_WRONLY, 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #426ef9d61ebff828 — Environment-variable access.
repo/internal/update/background.go:21 
	cmd.Env = append(os.Environ(), noUpdateCheckEnv+"=1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9dc2fa403c3fd75e — Filesystem access.
repo/internal/update/cache.go:30 
	if err := os.WriteFile(path, data, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #670df8eef49bc860 — Filesystem access.
repo/internal/update/cache.go:40 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b7d7892f49924d6c — Filesystem access.
repo/internal/update/replace.go:60 
	f, err := os.OpenFile(path, os.O_WRONLY|os.O_TRUNC, perm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2ebc1f8843d6cea3 — Environment-variable access.
repo/internal/update/update.go:155 
	if u.disableBackground || isDevVersion(u.currentVersion) || os.Getenv(noUpdateCheckEnv) == "1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4593276dd197ea08 — Environment-variable access.
repo/internal/update/update.go:174 
	if u == nil || u.disableBackground || isDevVersion(u.currentVersion) || os.Getenv(noUpdateCheckEnv) == "1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

github.com/charmbracelet/bubbletea

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #b3b8a616ec7251d5 — Filesystem access.
pkgs/go/[email protected]/logging.go:36 
	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0o600) //nolint:mnd

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee18a3be580e9b50 — Environment-variable access.
pkgs/go/[email protected]/tea.go:267 
		p.environ = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8190af3d7904f29 — Filesystem access.
pkgs/go/[email protected]/tty_unix.go:33 
	f, err := os.Open("/dev/tty")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4afc74b32dd67f73 — Filesystem access.
pkgs/go/[email protected]/tty_windows.go:59 
	f, err := os.OpenFile("CONIN$", os.O_RDWR, 0o644) //nolint:gosec

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/muesli/termenv

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #db2e6413d29dd63a — Environment-variable access.
pkgs/go/[email protected]/output.go:47 
	return os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #504146c9f8342085 — Environment-variable access.
pkgs/go/[email protected]/output.go:51 
	return os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/spf13/cobra

go dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #0f936da9c50a10cb — Environment-variable access.
pkgs/go/[email protected]/active_help.go:48 
	activeHelpCfg := os.Getenv(activeHelpGlobalEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4126991b9bed832d — Environment-variable access.
pkgs/go/[email protected]/active_help.go:50 
		activeHelpCfg = os.Getenv(activeHelpEnvVar(cmd.Root().Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44c4862dce1e30ce — Filesystem access.
pkgs/go/[email protected]/bash_completions.go:702 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40dd8da42e35bb96 — Filesystem access.
pkgs/go/[email protected]/bash_completionsV2.go:471 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bfd5ce3c000693d — Environment-variable access.
pkgs/go/[email protected]/completions.go:957 
	if path := os.Getenv("BASH_COMP_DEBUG_FILE"); path != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b0dd3a61fb5732c — Filesystem access.
pkgs/go/[email protected]/completions.go:958 
		f, err := os.OpenFile(path,
			os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e6ccad87b19f517 — Environment-variable access.
pkgs/go/[email protected]/completions.go:1015 
	v := os.Getenv(configEnvVar(cmd.Root().Name(), suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7944cc4b5cf43b88 — Environment-variable access.
pkgs/go/[email protected]/completions.go:1017 
		v = os.Getenv(configEnvVar(configEnvVarGlobalPrefix, suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e33a4d3c4a959e2c — Filesystem access.
pkgs/go/[email protected]/doc/man_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #628ca973b1618a29 — Environment-variable access.
pkgs/go/[email protected]/doc/man_docs.go:127 
		if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4c3dd6707655a7b — Filesystem access.
pkgs/go/[email protected]/doc/md_docs.go:145 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d38498f0520d7210 — Filesystem access.
pkgs/go/[email protected]/doc/rest_docs.go:157 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd55b7c66d4fa3f1 — Filesystem access.
pkgs/go/[email protected]/doc/yaml_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c2e4fa72e49a626 — Filesystem access.
pkgs/go/[email protected]/fish_completions.go:285 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e6ab3fb0ef6bbe6 — Filesystem access.
pkgs/go/[email protected]/powershell_completions.go:321 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0aa287986135f790 — Filesystem access.
pkgs/go/[email protected]/zsh_completions.go:71 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/sys

go dependency
expand_more 59 low-confidence finding(s)
low env_fs dependency Excluded from app score #8d0ea15c82e730a8 — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu.go:271 
	env := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #719e44e4266597de — Filesystem access.
pkgs/go/[email protected]/cpu/hwcap_linux.go:42 
	buf, err := os.ReadFile(procAuxv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd51e023e5b052eb — Filesystem access.
pkgs/go/[email protected]/cpu/proc_cpuinfo_linux.go:17 
	f, err := os.Open("/proc/cpuinfo")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdb8b2c2b63bbd07 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:90 
	goos := os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e69f3f56c2f6ef6 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:91 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d68ac2c08341db00 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:93 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36ded9084deaea4f — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:98 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd522d9ab108e493 — Filesystem access.
pkgs/go/[email protected]/plan9/mksyscall.go:127 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6744045b885ca0e5 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:443 
		src, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffa8607dedf8bb8b — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:467 
	f, err := os.Create(mergedFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5831b4a7984a896 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:494 
		err = os.WriteFile(inFile.name, src, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea0cec4f1fc7bd5f — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:182 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db166d18b9553556 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:317 
	if fmtCmd.Stdout, err = os.Create(outputFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fd7ed2c83996ce2 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:337 
	t.env = append(os.Environ(), fmt.Sprintf("%s=%s", "GOOS", GOOS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #353f0ccf33403808 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:447 
	if file, err := os.Create(stubsFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81bb400541ff538e — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:482 
	abiFile, err := os.Create(filepath.Join(abiDir, "abi.h"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dadb6b2b730313c1 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:631 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bc2847d51a14b90 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:756 
	f, err := os.Create(fmt.Sprintf("zptrace_%s_linux.go", archName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a904dfb6ae0c8cd — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:784 
	f, err := os.Create(fmt.Sprintf("zptrace_linux_%s.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8641de8e77b8e3f0 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:819 
	data, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81e6d84aedf06840 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:100 
	goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b8c2a7b9ceb1610 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:101 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #633fa01a73521b41 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:103 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10eccf36a71328b0 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:111 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c02c0e4b3baf24e — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:117 
	cc := os.Getenv("CC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59d4c778dfa89833 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:36 
		in, err := os.ReadFile(inFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d96d7d5385aac16 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:73 
	if err := os.WriteFile(outFileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a980319f22fe6c88 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:110 
	if err := os.WriteFile(fileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9be1af430ac397e7 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:26 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2525cffb87ca5417 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:28 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a157f52559432234 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:30 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76d11242cf7273ae — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:32 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9a6cad07e4b51f3 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:36 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a753fcd89ffa91e4 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:104 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfa0419e0f5878b3 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:106 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98835c71c96f7199 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:115 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fc24df2f50d43bc — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall.go:145 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4171a2fa5b57081 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc.go:100 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a07ab84a42ceca2 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:148 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86a20675ead4d9e7 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:521 
	err := os.WriteFile("zsyscall_aix_ppc64.go",
		[]byte(fmt.Sprintf(srcTemplate1, cmdLine(), goBuildTags(), pack, imp, textcommon)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #050089f9bd757d1b — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:532 
	err = os.WriteFile("zsyscall_aix_ppc64_gc.go",
		[]byte(fmt.Sprintf(srcTemplate2, cmdLine(), goBuildTags(), pack, imp, dynimports, linknames, vardecls, textgc)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8299aca9a05decbb — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:541 
	err = os.WriteFile("zsyscall_aix_ppc64_gccgo.go",
		[]byte(fmt.Sprintf(srcTemplate3, cmdLine(), goBuildTags(), pack, cExtern, imp, textgccgo)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11cfbd40ab4b22ef — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_solaris.go:103 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebae2641aec6d8d7 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:208 
	f, err := os.Open(*inputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0891445e085fb8ba — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:216 
	fasm, asmerr := os.Create(*outasm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5343b638366dd348 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:230 
	fgo, goerr := os.Create(*outputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b082ca897378ad7 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:272 
	f, err := os.Create(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bf8a716cbf1c3c2 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:122 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc7dc11cdb58d224 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:124 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d58818dabad44b9 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:127 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #065e0da2a8e76178 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:129 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1277174ca526fe21 — Filesystem access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:259 
		file, err := os.Open(filepath.Join("/usr/include", header))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ac471fd846fd33e — Filesystem access.
pkgs/go/[email protected]/unix/mksysnum.go:70 
	file, err := os.Open(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c61ff25f9a0b208 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:90 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f27d8570c933a71a — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:92 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37bb0a778d31018e — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:95 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2de3d4d338861b5 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:97 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1dde2a32271a8443 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:710 
	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a642b8ea5b15d6e0 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:894 
		err = os.WriteFile(*filename, data, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • modernc.org/sqlite prod — module zip exceeds byte cap