Close Open Privacy Scan

link https://github.com/infiniflow/ragflow
bolt Snapshot: commit 92ae4f6
science engine v1.5
schedule 2026-07-16T07:19:15.083237+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

smart_toy MCP server detected: anthropic, cohere, langgraph, litellm +2 more — detected in dependencies, not a safety judgment.

App Privacy Score

87 /100
Low privacy risk

Low risk · 402 finding(s)

Dependency score: 67 (Medium risk)

bar_chart Score Breakdown

egress −10
env_fs −3

list Scan Summary

1 high 0 medium 401 low
First-party packages: 1
Dependency packages: 24
Ecosystem: go

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)
high github.com/minio/minio-go/v7 dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/go/[email protected]/functional_tests.go:13515 → pkgs/go/[email protected]/functional_tests.go:14162

</> First-Party Code

first-party (python)

go first-party
expand_more 105 low-confidence finding(s)
low env_fs production #ed9c6ede31659a6f — Environment-variable access.
repo/internal/agent/component/io/pdf_writer.go:170 
	if explicit := strings.TrimSpace(os.Getenv("RAGFLOW_PDF_FONT_PATH")); explicit != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3402a2d2517006d5 — Environment-variable access.
repo/internal/agent/component/io/pdf_writer.go:179 
	if explicit := strings.TrimSpace(os.Getenv(envKey)); explicit != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fa98b429ec11e920 — Filesystem access.
repo/internal/agent/component/io/pdf_writer.go:325 
	return os.ReadFile(tmpName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0504a822783fa927 — Filesystem access.
repo/internal/agent/sandbox/local.go:174 
	if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6c50ba0ee219550c — Filesystem access.
repo/internal/agent/sandbox/local.go:274 
		if err := os.WriteFile(scriptPath, []byte(BuildPythonWrapper(code, argsJSON)), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1438ff9b625f43cd — Filesystem access.
repo/internal/agent/sandbox/local.go:281 
		if err := os.WriteFile(scriptPath, []byte(BuildJavaScriptWrapper(code, argsJSON)), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a54858a1954514e1 — Filesystem access.
repo/internal/agent/sandbox/local.go:440 
	if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #acce0638d5b1da48 — Filesystem access.
repo/internal/agent/sandbox/local.go:537 
		body, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4508cff5eb28b79d — Filesystem access.
repo/internal/agent/sandbox/ssh.go:177 
		if b, err := os.ReadFile(keyPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b5e5f74f588e070 — Filesystem access.
repo/internal/cli/cli.go:239 
		data, err := os.ReadFile(configFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f4981d22c504cefe — Filesystem access.
repo/internal/cli/cli.go:382 
	data, err := os.ReadFile("rf.yml")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23c304b656229cf7 — Filesystem access.
repo/internal/cli/cli.go:401 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f99d497c276331d — Filesystem access.
repo/internal/cli/cli.go:690 
	if f, err := os.Open(histFile); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f0be2a15636f403 — Filesystem access.
repo/internal/cli/cli.go:697 
		if f, err := os.Create(histFile); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #007f539cf5534fa3 — Filesystem access.
repo/internal/cli/cli.go:921 
	publicKeyPEM, err := os.ReadFile(*publicKeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #90839733b67a5ea0 — Filesystem access.
repo/internal/cli/filesystem/skill.go:1591 
			content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de454ab444c9f92f — Filesystem access.
repo/internal/cli/filesystem/skill_hub/source/local.go:59 
	content, err := os.ReadFile(skillMdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f69bf49d23414424 — Filesystem access.
repo/internal/cli/filesystem/skill_hub/source/local.go:115 
		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5e8ee58451237bdf — Filesystem access.
repo/internal/cli/filesystem/skill_hub/source/local.go:147 
	content, err := os.ReadFile(skillMdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9ca75b4c1005df31 — Filesystem access.
repo/internal/cli/filesystem/skill_install.go:288 
		if err := os.WriteFile(filePath, content, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13eaeb490e56d03c — Filesystem access.
repo/internal/cli/user_command.go:2042 
				imageContent, err := os.ReadFile(image)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #29242d5c5c9153e1 — Filesystem access.
repo/internal/cli/user_command.go:2084 
		audioContent, err := os.ReadFile(audioFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0a4cf2e1f7a3798 — Filesystem access.
repo/internal/cli/user_command.go:2560 
	if err := os.WriteFile(localPath, audioBytes, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6eecceeea7456be0 — Filesystem access.
repo/internal/cli/user_command.go:2586 
			if err := os.WriteFile(finalPath, audioBytes, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21e530ec951f0e88 — Filesystem access.
repo/internal/cli/user_command.go:2765 
		fileContent, err = os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39157d226096e853 — Filesystem access.
repo/internal/cli/user_command.go:2854 
			fileContent, err = os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac7b301447eccd79 — Filesystem access.
repo/internal/cli/user_command.go:3556 
	fileContent, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1c4849ea2dbe277 — Filesystem access.
repo/internal/cli/user_command.go:3778 
	optionsRaw, err := os.ReadFile(optionsFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e6c0f4544728e8d — Filesystem access.
repo/internal/cli/user_command.go:3799 
		fileToChunking, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19fb4fdc2d364299 — Environment-variable access.
repo/internal/common/environments.go:25 
	return os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e56c7e945933edfd — Filesystem access.
repo/internal/common/password.go:202 
	keyData, err := os.ReadFile("conf/private.pem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb2858ed8eb1d123 — Filesystem access.
repo/internal/common/version.go:55 
		if data, err = os.ReadFile(versionPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ce565753adea5c5f — Filesystem access.
repo/internal/dao/canvas_template_seed.go:80 
		raw, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #573e35901135f2bb — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/char_adapter.go:23 
	data, err := os.ReadFile(jsonPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f9fcaa903f05dd72 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:86 
		if goTxt, err := os.ReadFile(goTextPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #33eaa84954626d15 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:87 
			if pyTxt, err := os.ReadFile(pyTextPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bdffa295164f5c68 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:207 
	f, err := os.Create(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d8e57720055f2c9 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:380 
		goData, _ := os.ReadFile(goPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2e9086ba8f1d7564 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:388 
		pyData, _ := os.ReadFile(pyPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9fc8f8486cf76e55 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:517 
		goData, _ := os.ReadFile(filepath.Join(goDLADir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5fc64e4ba97e9401 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:518 
		pyData, _ := os.ReadFile(filepath.Join(pyDLADir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7661ec17daceb549 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:588 
		goData, _ := os.ReadFile(filepath.Join(goTSRDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #092e16e497d3dcf9 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/compare.go:589 
		pyData, _ := os.ReadFile(filepath.Join(pyTSRDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4787aeeeb204a05c — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/metadata.go:22 
		data, err := os.ReadFile(filepath.Join(pyTextDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c48b9394101df027 — Filesystem access.
repo/internal/deepdoc/parser/pdf/tool/metadata.go:61 
		data, err := os.ReadFile(filepath.Join(goTextDir, e.Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fbd06acd3bdff3f3 — Filesystem access.
repo/internal/engine/elasticsearch/chunk.go:2406 
		data, err = os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8250c17bcc46c070 — Filesystem access.
repo/internal/engine/elasticsearch/client.go:155 
	data, err := os.ReadFile(*mappingPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d2de91992cc85714 — Filesystem access.
repo/internal/engine/infinity/chunk.go:75 
	schemaData, err := os.ReadFile(*fpMapping)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2938a7112122a49d — Filesystem access.
repo/internal/engine/infinity/metadata.go:62 
	schemaData, err := os.ReadFile(*fpMapping)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d5a8319dbfc4929 — Filesystem access.
repo/internal/engine/infinity/sql.go:67 
	data, err := os.ReadFile(*filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39357a189b065b89 — Filesystem access.
repo/internal/entity/models/302ai.go:566 
	audioFile, err := os.Open(strings.TrimSpace(*file))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53521eb990d235aa — Filesystem access.
repo/internal/entity/models/cohere.go:531 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1e17443cb1032804 — Filesystem access.
repo/internal/entity/models/cometapi.go:563 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e8c9cab2d1aae310 — Filesystem access.
repo/internal/entity/models/deepinfra.go:542 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #411411a25c10c145 — Filesystem access.
repo/internal/entity/models/fishaudio.go:94 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ffd43a467c84ee4 — Filesystem access.
repo/internal/entity/models/groq.go:378 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2a5885a3741c43c7 — Filesystem access.
repo/internal/entity/models/model.go:262 
		data, err = os.ReadFile(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a010700769a08d7a — Filesystem access.
repo/internal/entity/models/model.go:307 
	data, err = os.ReadFile(filepath.Join(findRepoRoot(), "conf", "all_models.json"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b36371f717f3798b — Filesystem access.
repo/internal/entity/models/openai.go:835 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #affeb325951b3df0 — Filesystem access.
repo/internal/entity/models/openrouter.go:561 
	audio, err := os.ReadFile(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af1c3408e386cebc — Filesystem access.
repo/internal/entity/models/ragcon.go:609 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #86e928bb234d8ce6 — Filesystem access.
repo/internal/entity/models/siliconflow.go:742 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #15515231ee3eaac2 — Filesystem access.
repo/internal/entity/models/togetherai.go:543 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b620b54da6e851b4 — Filesystem access.
repo/internal/entity/models/xai.go:480 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6d9be1172ab792b3 — Filesystem access.
repo/internal/entity/models/xiaomi.go:472 
	audio, err := os.ReadFile(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #49aba5835a946f9e — Filesystem access.
repo/internal/entity/models/xinference.go:564 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6f9837b5b34e44f7 — Filesystem access.
repo/internal/entity/models/zhipu-ai.go:689 
	audioFile, err := os.Open(*file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18d06954771203b1 — Filesystem access.
repo/internal/handler/tenant.go:358 
	data, err := os.ReadFile(req.FilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1877930f1c995944 — Filesystem access.
repo/internal/handler/tenant.go:436 
	data, err := os.ReadFile(req.FilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #783723c88b7f5255 — Filesystem access.
repo/internal/harness/core/evals/evals.go:346 
		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d2e685c1a15011f1 — Filesystem access.
repo/internal/harness/core/evals/evals.go:361 
		data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c49ef7d3fe89d8b — Filesystem access.
repo/internal/harness/core/evals/evals.go:505 
		data, _ := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6497e4e1be1d0495 — Filesystem access.
repo/internal/harness/core/evals/evals.go:518 
	if err := os.WriteFile(filepath.Join(dir, "summary.json"), []byte(summary), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37daba3318854d9d — Filesystem access.
repo/internal/harness/core/evals/evals.go:536 
	return os.WriteFile(filepath.Join(dir, "results.csv"), []byte(buf.String()), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7d6a1fd41449b7d1 — Filesystem access.
repo/internal/harness/core/middlewares/skill/filesystem_backend.go:19 
	data, err := os.ReadFile(b.resolve(path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #67cdee55731628ea — Filesystem access.
repo/internal/harness/core/prebuilt/coding/coding.go:190 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #33d935f2cf8aed7b — Filesystem access.
repo/internal/harness/core/prebuilt/coding/coding.go:198 
	return os.WriteFile(path, []byte(content), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5eeb090892bc4ae9 — Filesystem access.
repo/internal/harness/core/prebuilt/coding/coding.go:202 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b8cde47502243bb — Filesystem access.
repo/internal/harness/core/prebuilt/coding/coding.go:211 
	return os.WriteFile(path, []byte(content), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #009e74c69a5d2e53 — Filesystem access.
repo/internal/harness/core/prompt_builder.go:105 
		content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8c064e896a46e87d — Filesystem access.
repo/internal/harness/core/prompt_builder.go:118 
				content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5891d122f04ff56b — Filesystem access.
repo/internal/harness/core/prompt_builder.go:202 
	data, err := os.ReadFile(filepath.Join(root, ".git", "HEAD"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #24e599607ae81205 — Filesystem access.
repo/internal/harness/events/localfile.go:98 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3e4897463687f42 — Filesystem access.
repo/internal/harness/events/localfile.go:154 
	f, err := os.OpenFile(fpath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c10b8e7dd6566e68 — Filesystem access.
repo/internal/ingestion/component/docx_vision_dispatch.go:247 
	content, err := os.ReadFile(promptPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #abb149ba4c159299 — Filesystem access.
repo/internal/ingestion/component/pdf_vision_dispatch.go:494 
	content, err := os.ReadFile(promptPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #31b70dad2b829693 — Environment-variable access.
repo/internal/ingestion/component/tokenizer.go:118 
	if v := os.Getenv("COMPONENT_EXEC_TIMEOUT_TOKENIZER"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97f89237140d1263 — Filesystem access.
repo/internal/ingestion/task/tool/compare_pipeline_golden.go:257 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3bae58dc1a47c34a — Filesystem access.
repo/internal/ingestion/task/tool/compare_pipeline_golden.go:267 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f3d0fcf58ca4e4ac — Environment-variable access.
repo/internal/parser/parser/xls_tcadp.go:22 
		baseURL = strings.TrimSpace(os.Getenv("TCADP_APISERVER"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72bc31c98ad9439a — Environment-variable access.
repo/internal/parser/parser/xls_tcadp.go:29 
		apiKey = strings.TrimSpace(os.Getenv("TCADP_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #e5d3f56b06d528f6 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/internal/service/chat_pipeline.go:1770 
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, tavilyURL, bytes.NewReader(bodyBytes))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c1fef0847faca8bf — Hardcoded external endpoint. Review what data is sent to this destination.
repo/internal/service/connector.go:1198 
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, boxOAuthTokenURL, strings.NewReader(form.Encode()))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #43dff1afe84944d0 — Filesystem access.
repo/internal/service/load_prompt.go:81 
	content, err := os.ReadFile(promptPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e33d15e4bdc2374c — Filesystem access.
repo/internal/service/metadata_filter.go:110 
		content, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7de84b4eaec4bd5 — Environment-variable access.
repo/internal/service/model_service.go:1382 
		value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7cba3e36b4a948e2 — Filesystem access.
repo/internal/service/nlp/synonym.go:80 
	if data, err := os.ReadFile(path); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6db00b5b1d8f2dfa — Filesystem access.
repo/internal/service/nlp/term_weight.go:60 
	if data, err := os.ReadFile(nerPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79f270a93ea01e92 — Filesystem access.
repo/internal/service/nlp/term_weight.go:94 
	data, err := os.ReadFile(fnm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8387eaf46ed9bc13 — Filesystem access.
repo/internal/service/nlp/wordnet.go:145 
		file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #505d439588e8b250 — Filesystem access.
repo/internal/service/nlp/wordnet.go:172 
		file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #461a6cd819024a6e — Filesystem access.
repo/internal/service/nlp/wordnet.go:333 
	file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #125100e7289b135b — Filesystem access.
repo/tools/migrate-canvas/main.go:96 
	raw, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ecea4210f1a17d68 — Filesystem access.
repo/tools/migrate-canvas/main.go:112 
		if err := os.WriteFile(goldenPath, out, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3d3e6435dcad9cc2 — Filesystem access.
repo/tools/migrate-canvas/main.go:120 
		golden, gErr := os.ReadFile(goldenPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

github.com/minio/minio-go/v7

go dependency
high pii_flow dependency Excluded from app score #84f0ab4614272d54 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/go/[email protected]/functional_tests.go:14162 · flow /tmp/closeopen-7ahpchut/pkgs/go/[email protected]/functional_tests.go:13515 → /tmp/closeopen-7ahpchut/pkgs/go/[email protected]/functional_tests.go:14162 
			req, err := http.NewRequestWithContext(ctx, test.method, test.url, nil)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 71 low-confidence finding(s)
low env_fs dependency Excluded from app score #6e5f1b693eb1ff7b — Filesystem access.
pkgs/go/[email protected]/api-get-object-file.go:75 
	filePart, err := os.OpenFile(filePartPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19c375c78fb0f6fa — Filesystem access.
pkgs/go/[email protected]/api-put-object-file-context.go:40 
	fileReader, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5be7ceff428bbe6a — Filesystem access.
pkgs/go/[email protected]/api-putobject-snowball.go:138 
			f, err := os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a91e34e5d1e81d3f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:80 
	transport, err = minio.DefaultTransport(mustParseBool(os.Getenv(enableHTTPS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0736c2fce318d60 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:86 
	if mustParseBool(os.Getenv(enableHTTPS)) && mustParseBool(os.Getenv(skipCERTValidation)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3679410e9189bd88 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:266 
	return os.Getenv("RUN_ON_FAIL") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a75f9502b4863be5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:272 
	if os.Getenv(serverEndpoint) == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #293cd95dd1f8718a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:280 
var mintDataDir = os.Getenv("MINT_DATA_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b74f256d2e204f51 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:338 
	reader, _ := os.Open(getMintDataDirFilePath(fileName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b990c11c245d85c — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:342 
		reader, _ = os.Open(getMintDataDirFilePath(fileName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b72bc7f4ffef2708 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:384 
	return os.Getenv("MINT_MODE") == "full"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6124eb0541a66e5a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:407 
		creds = credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba042c1252790048 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:409 
		creds = credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9ebc66c6a10072a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:414 
		Secure:          mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1f7453e9c2a54f4 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:417 
	client, err := minio.New(os.Getenv(serverEndpoint), opts)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a56434a947f6fc3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2107 
		if os.Getenv("MINT_NO_FULL_OBJECT") != "" && test.cs.FullObjectRequested() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e339cdaebab8c55 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2293 
		if os.Getenv("MINT_NO_FULL_OBJECT") != "" && test.cs.FullObjectRequested() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a027df66c5aa8456 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2508 
		if os.Getenv("MINT_NO_FULL_OBJECT") != "" && test.cs.FullObjectRequested() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87fec308d4822548 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3017 
		if mustParseBool(os.Getenv(enableHTTPS)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bb353abfdd2aea2 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:4576 
	srcFile, err := os.Open(fName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #905148d8c48b3a72 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:4583 
	tmpFile, err := os.Create(fName + ".gtar")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #972d40fc6e0b92eb — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:5606 
	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #838bc87193965328 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5656 
	if mustParseBool(os.Getenv(enableHTTPS)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e473f1be4bd505ac — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5662 
	expectedLocation := scheme + os.Getenv(serverEndpoint) + "/" + bucketName + "/" + objectName

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8301c4e917b0f31d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5663 
	expectedLocationBucketDNS := scheme + bucketName + "." + os.Getenv(serverEndpoint) + "/" + objectName

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2748912c0bffa534 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:5799 
	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44c30a02ca268385 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:5956 
	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5574484547365632 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:7025 
		file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0612eb2d7722d463 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:7227 
		file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73606429bb57499f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7282 
	if os.Getenv("NOTIFY_BUCKET") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b45ecab22732ae95 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7283 
		os.Getenv("NOTIFY_SERVICE") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e82050862a24c6c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7284 
		os.Getenv("NOTIFY_REGION") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #413d00dbfc3244fb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7285 
		os.Getenv("NOTIFY_ACCOUNTID") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db8292f049f6aca6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7286 
		os.Getenv("NOTIFY_RESOURCE") == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f4466d39781fbd9 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7297 
	bucketName := os.Getenv("NOTIFY_BUCKET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce8c4ef5251241f0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7300 
	topicArn := notification.NewArn("aws", os.Getenv("NOTIFY_SERVICE"), os.Getenv("NOTIFY_REGION"), os.Getenv("NOTIFY_ACCOUNTID"), os.Getenv("NOTIFY_RESOURCE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73b17a7b72faa2ed — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:7395 
	file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8b69177b56894dc — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:8141 
		tempfile, err = os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c671835db99a75e4 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:12357 
	file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79c7ab1619d1fd87 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13098 
	if os.Getenv(serverEndpoint) != "s3.amazonaws.com" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4b546dc220523d3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13515 
	bucketName := os.Getenv("MINIO_GO_TEST_BUCKET_CORS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f57246357079c859 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:14783 
	tls := mustParseBool(os.Getenv(enableHTTPS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6bfd97c9b27d29e6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:14784 
	kms := mustParseBool(os.Getenv(enableKMS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01c7ee1289af4645 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:14785 
	if os.Getenv(enableKMS) == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f183999537419633 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:43 
	id := os.Getenv("AWS_ACCESS_KEY_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9c00b5441e4c702 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:45 
		id = os.Getenv("AWS_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #304811c0f55cfcad — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:48 
	secret := os.Getenv("AWS_SECRET_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5641f1321a77f89 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:50 
		secret = os.Getenv("AWS_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08132b4607163a7c — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:62 
		SessionToken:    os.Getenv("AWS_SESSION_TOKEN"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a3df2a061c63e82 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:44 
	id := os.Getenv("MINIO_ROOT_USER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #408a68a6f38dbc96 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:45 
	secret := os.Getenv("MINIO_ROOT_PASSWORD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9729b8c5a7bcc4eb — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:49 
		id = os.Getenv("MINIO_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d042be9baf382bc3 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:50 
		secret = os.Getenv("MINIO_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f4d3e2d5263b04e — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_aws_credentials.go:76 
		p.Filename = os.Getenv("AWS_SHARED_CREDENTIALS_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c1dbb32c31960ad — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_aws_credentials.go:86 
		p.Profile = os.Getenv("AWS_PROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eed3a090ae87301b — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:60 
		if value, ok := os.LookupEnv("MINIO_SHARED_CREDENTIALS_FILE"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a44cf51fb76f1bc — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:75 
		p.Alias = os.Getenv("MINIO_ALIAS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6306a9f7a41c6be — Filesystem access.
pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:132 
	configBytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff9f15c3e22c42a1 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:103 
	token := os.Getenv("AWS_CONTAINER_AUTHORIZATION_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2576e57694a00838 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:108 
	tokenFile := os.Getenv("AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #527c07c288a12390 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:113 
	relativeURI := os.Getenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69c3ea0852ab5d2d — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:118 
	fullURI := os.Getenv("AWS_CONTAINER_CREDENTIALS_FULL_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7be28c2fdd4c70f0 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:123 
	identityFile := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebcbd4c1a5719524 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:128 
	roleArn := os.Getenv("AWS_ROLE_ARN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de5f0b4eaf3128c3 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:133 
	roleSessionName := os.Getenv("AWS_ROLE_SESSION_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3158f68ca2374434 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:138 
	region := os.Getenv("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a65f5ff2f59fa078 — Filesystem access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:174 
				token, err := os.ReadFile(identityFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #680a16b37789601d — Filesystem access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:335 
		bytes, err := os.ReadFile(tokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bec5c03f55194f5f — Filesystem access.
pkgs/go/[email protected]/pkg/credentials/sts_web_identity.go:121 
		token, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c57c7348eec7f146 — Environment-variable access.
pkgs/go/[email protected]/transport.go:72 
		if f := os.Getenv("SSL_CERT_FILE"); f != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50906a8f7a460eef — Filesystem access.
pkgs/go/[email protected]/transport.go:74 
			data, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cloud.google.com/go/storage

go dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #faaf68b15dd660d0 — Environment-variable access.
pkgs/go/[email protected]/grpc_client.go:95 
	if host := os.Getenv("STORAGE_EMULATOR_HOST_GRPC"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c97e63be9259685e — Environment-variable access.
pkgs/go/[email protected]/grpc_client.go:112 
		if disableBoundToken, _ := strconv.ParseBool(os.Getenv("STORAGE_DISABLE_DIRECTPATH_BOUND_TOKEN")); !disableBoundToken {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee61e7d228dd4062 — Environment-variable access.
pkgs/go/[email protected]/grpc_dp_diag.go:53 
	if strings.EqualFold(os.Getenv(directPathDisableEnvVar), "true") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #632d533a79e7b539 — Environment-variable access.
pkgs/go/[email protected]/http_client.go:78 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aff1159e8d8dc5c6 — Environment-variable access.
pkgs/go/[email protected]/invoke.go:52 
		return os.Getenv("GOOGLE_SDK_GO_TRACING_COOKIE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #484606a84ce4ae68 — Environment-variable access.
pkgs/go/[email protected]/option.go:52 
	increaseRate := os.Getenv(dynamicReadReqIncreaseRateEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abe0d637088da41a — Environment-variable access.
pkgs/go/[email protected]/option.go:67 
	initialTimeout := os.Getenv(dynamicReadReqInitialTimeoutEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31b9a158a3613662 — Environment-variable access.
pkgs/go/[email protected]/storage.go:162 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a41bbcf3a8b8013a — Environment-variable access.
pkgs/go/[email protected]/storage.go:382 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e35944af75925599 — Environment-variable access.
pkgs/go/[email protected]/storage.go:394 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae4c3fef8203489e — Environment-variable access.
pkgs/go/[email protected]/trace.go:65 
	return os.Getenv(storageOtelTracingDevVar) == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2888692da0530544 — Environment-variable access.
pkgs/go/[email protected]/trace.go:69 
	return os.Getenv(storageBucketMetadataDisabledVar) != "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93af49da9708a906 — Filesystem access.
pkgs/go/[email protected]/transfermanager/downloader.go:221 
		f, fErr := os.Create(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/alibabacloud-go/darabonba-openapi/v2

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #412c82d0139e3c39 — Environment-variable access.
pkgs/go/[email protected]/client/client.go:115 
		client.UserAgent = dara.String(os.Getenv("ALIBABA_CLOUD_USER_AGENT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/alicebob/miniredis/v2

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #18bfdd9c0c9600a7 — Environment-variable access.
pkgs/go/[email protected]/integration/ephemeral.go:73 
	os.Setenv("PATH", fmt.Sprintf("%s:%s", absSrc, os.Getenv("PATH")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #222767c741ffd780 — Environment-variable access.
pkgs/go/[email protected]/integration/test.go:20 
	if os.Getenv("INT") == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1c16d430b140ed6 — Filesystem access.
pkgs/go/[email protected]/integration/tls.go:17 
	rootca, err := ioutil.ReadFile("../testdata/client.crt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #772a086746f0d856 — Filesystem access.
pkgs/go/[email protected]/integration/tls.go:38 
	rootca, err := ioutil.ReadFile("../testdata/server.crt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2

go dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #0e1c5d3f6af9eac0 — Filesystem access.
pkgs/go/[email protected]/aws/generate.go:29 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82e3641c291d9f74 — Filesystem access.
pkgs/go/[email protected]/aws/logging_generate.go:85 
	file, err := os.Create("logging.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4808c8de6013e6b — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/recursion_detection.go:40 
	_, hasLambdaEnv := os.LookupEnv(envAwsLambdaFunctionName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f7a031cfc02e0a2 — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/recursion_detection.go:41 
	xAmznTraceID, hasTraceID := os.LookupEnv(envAmznTraceID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b7a5b0ee580eace — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/user_agent.go:208 
	if ev := os.Getenv(execEnvVar); len(ev) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9de45711769b495 — Environment-variable access.
pkgs/go/[email protected]/internal/awstesting/util.go:106 
	originalEnv := os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2222733c03722174 — Environment-variable access.
pkgs/go/[email protected]/internal/awstesting/util.go:150 
		if val, ok := os.LookupEnv(env); ok && len(val) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3d766f2a4809b21 — Filesystem access.
pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:102 
	modelFile, err := os.Open(modelFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5227d0623bc7b9a7 — Filesystem access.
pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:113 
	file, err := os.Create(outputFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/config

go dependency
expand_more 37 low-confidence finding(s)
low env_fs dependency Excluded from app score #ab89caef8ccfc109 — Filesystem access.
pkgs/go/[email protected]/codegen/main.go:94 
	file, err := os.OpenFile(config.OutputPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0744)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f9972a16ba06c55 — Environment-variable access.
pkgs/go/[email protected]/config.go:228 
	if os.Getenv(awsProfileEnv) != "" || options.SharedConfigProfile != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d80947c67d40f0e8 — Environment-variable access.
pkgs/go/[email protected]/defaultsmode.go:43 
		EnvironmentIdentifier:     aws.ExecutionEnvironmentID(os.Getenv(execEnvVar)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a8eab3826fe1ad0 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:331 
		creds.AccountID = os.Getenv(awsAccountIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce1489514fda9802 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:332 
		creds.SessionToken = os.Getenv(awsSessionTokenEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40837304aae3c086 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:336 
	cfg.ContainerCredentialsEndpoint = os.Getenv(awsContainerCredentialsFullURIEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1893bb490e5812e — Environment-variable access.
pkgs/go/[email protected]/env_config.go:337 
	cfg.ContainerCredentialsRelativePath = os.Getenv(awsContainerCredentialsRelativeURIEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df1e6d44069da0bc — Environment-variable access.
pkgs/go/[email protected]/env_config.go:338 
	cfg.ContainerAuthorizationToken = os.Getenv(awsContainerAuthorizationTokenEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #939e8e06d27774f7 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:343 
	cfg.SharedCredentialsFile = os.Getenv(awsSharedCredentialsFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b4b150d5731b3b8 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:344 
	cfg.SharedConfigFile = os.Getenv(awsConfigFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73063ba1d9a16ed2 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:346 
	cfg.CustomCABundle = os.Getenv(awsCABundleEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #501e7c0ec86d58a8 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:348 
	cfg.WebIdentityTokenFilePath = os.Getenv(awsWebIdentityTokenFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f839885f954eb7c4 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:350 
	cfg.RoleARN = os.Getenv(awsRoleARNEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37ee8f9d7cf85c20 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:351 
	cfg.RoleSessionName = os.Getenv(awsRoleSessionNameEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf7b002e4c145061 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:353 
	cfg.AppID = os.Getenv(awsSdkUaAppIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8491b6046f15889d — Environment-variable access.
pkgs/go/[email protected]/env_config.go:374 
	cfg.EC2IMDSEndpoint = os.Getenv(awsEc2MetadataServiceEndpointEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f50eaf015599adee — Environment-variable access.
pkgs/go/[email protected]/env_config.go:423 
	cfg.AuthSchemePreference = toAuthSchemePreferenceList(os.Getenv(awsAuthSchemePreferenceEnv))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85b11c1c353185a7 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:485 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9038f7b14773b034 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:503 
		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca279309228de1e2 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:515 
		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f4cf9be80590181 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:528 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed04d38ce1828c6a — Environment-variable access.
pkgs/go/[email protected]/env_config.go:541 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f4edc9d640a90b7 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:563 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80fec52b5410240d — Environment-variable access.
pkgs/go/[email protected]/env_config.go:582 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e1c33b9c70cee69 — Filesystem access.
pkgs/go/[email protected]/env_config.go:656 
	b, err := os.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5e416bd32c80cf9 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:680 
	if endpt := os.Getenv(fmt.Sprintf("%s_%s", awsEndpointURLEnv, normalizeEnv(sdkID))); endpt != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fc8b3a57fc95500 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:733 
		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e3aeef80f1c1705 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:742 
		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e28b3182e917aa87 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:757 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a31cfb34f8b8277 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:784 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #305e0b180306393b — Environment-variable access.
pkgs/go/[email protected]/env_config.go:808 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb9dfcb3d7ce4a32 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:831 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ffb5044799bb8a5 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:852 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52f9567a0506c90c — Environment-variable access.
pkgs/go/[email protected]/resolve_credentials.go:345 
			if authFilePath := os.Getenv(httpProviderAuthFileEnvVar); authFilePath != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31cdd76692278fd3 — Filesystem access.
pkgs/go/[email protected]/resolve_credentials.go:349 
					if contents, err = ioutil.ReadFile(authFilePath); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff7ecb818f5ad1a7 — Environment-variable access.
pkgs/go/[email protected]/resolve_credentials.go:635 
	cacheDir := os.Getenv("AWS_LOGIN_CACHE_DIRECTORY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9f4c5bca674f914 — Filesystem access.
pkgs/go/[email protected]/shared_config.go:505 
	b, err := ioutil.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/credentials

go dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #896196e610db6bd5 — Filesystem access.
pkgs/go/[email protected]/logincreds/file.go:9 
	return os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5324fdea9c0d98fa — Filesystem access.
pkgs/go/[email protected]/logincreds/file.go:13 
	return os.Create(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf0cd454cd6fa1ed — Environment-variable access.
pkgs/go/[email protected]/processcreds/provider.go:107 
	cmd.Env = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d9e448cb56aac4b — Filesystem access.
pkgs/go/[email protected]/ssocreds/sso_cached_token.go:148 
	fileBytes, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #601b3add5cf29cb9 — Filesystem access.
pkgs/go/[email protected]/ssocreds/sso_cached_token.go:181 
	f, err = os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_RDWR, fileMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ffe07bb25b455b1 — Filesystem access.
pkgs/go/[email protected]/stscreds/web_identity_provider.go:83 
	b, err := ioutil.ReadFile(string(j))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/service/s3

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #517a8c7ba76d386e — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:219 
	_, g := os.LookupEnv("AWS_ENDPOINT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a841b2a8e6629d4 — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:220 
	_, s := os.LookupEnv("AWS_ENDPOINT_URL_S3")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/service/sts

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #bb8e6e1d159250ac — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:209 
	_, g := os.LookupEnv("AWS_ENDPOINT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae4161022ab997d5 — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:210 
	_, s := os.LookupEnv("AWS_ENDPOINT_URL_STS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/smithy-go

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #2f8ca27fa36b73c5 — Filesystem access.
pkgs/go/[email protected]/middleware/generate.go:510 
		f, err := os.Create(step.Filepath())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f90f9b8f4a30b95 — Filesystem access.
pkgs/go/[email protected]/ptr/generate.go:29 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/browserbase/stagehand-go/v3

go dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #f6188deef82c16aa — Environment-variable access.
pkgs/go/[email protected]/client.go:29 
	if o, ok := os.LookupEnv("STAGEHAND_API_URL"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ada6b0f2ffcbcfb2 — Environment-variable access.
pkgs/go/[email protected]/client.go:31 
	} else if o, ok := os.LookupEnv("STAGEHAND_BASE_URL"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbfa019977db7d23 — Environment-variable access.
pkgs/go/[email protected]/client.go:34 
	if o, ok := os.LookupEnv("BROWSERBASE_API_KEY"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66d692ce25776d0e — Environment-variable access.
pkgs/go/[email protected]/client.go:37 
	if o, ok := os.LookupEnv("MODEL_API_KEY"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c96b9241db3a298 — Environment-variable access.
pkgs/go/[email protected]/client.go:40 
	if o, ok := os.LookupEnv("STAGEHAND_CUSTOM_HEADERS"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ec647243d2f1ad1 — Environment-variable access.
pkgs/go/[email protected]/internal/testutil/testutil.go:13 
		if str, ok := os.LookupEnv(SKIP_MOCK_TESTS); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e88f18666c0f62c6 — Environment-variable access.
pkgs/go/[email protected]/lib/local/local.go:86 
		cacheBase = os.Getenv("LOCALAPPDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d310b0b45d63e967 — Environment-variable access.
pkgs/go/[email protected]/lib/local/local.go:96 
		cacheBase = os.Getenv("XDG_CACHE_HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d067981c21d37cf — Environment-variable access.
pkgs/go/[email protected]/lib/local/local.go:137 
	version := os.Getenv("STAGEHAND_SERVER_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a4f664a25bb763b — Filesystem access.
pkgs/go/[email protected]/lib/local/local.go:238 
	file, err := os.OpenFile(tmpPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2a291037068d678 — Environment-variable access.
pkgs/go/[email protected]/lib/local/local.go:346 
	env := append([]string{}, os.Environ()...)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1053796cb1da0b7a — Environment-variable access.
pkgs/go/[email protected]/local_client.go:33 
		if key := os.Getenv("MODEL_API_KEY"); key != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d773fd543bcbcb55 — Environment-variable access.
pkgs/go/[email protected]/local_client.go:43 
		if key := os.Getenv("BROWSERBASE_API_KEY"); key != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/cespare/xxhash/v2

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #00988e4a49749e0a — Filesystem access.
pkgs/go/[email protected]/xxhsum/xxhsum.go:24 
		f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/denisenkom/go-mssqldb

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #55505612c1baf1cb — Filesystem access.
pkgs/go/[email protected]/msdsn/conn_str.go:92 
	pem, err := ioutil.ReadFile(certificate)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/elastic/go-elasticsearch/v8

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #a27f4604e344b641 — Environment-variable access.
pkgs/go/[email protected]/elasticsearch.go:183 
	compatHeaderEnv := os.Getenv(esCompatHeader)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #515c8267f524fbd5 — Environment-variable access.
pkgs/go/[email protected]/elasticsearch.go:227 
	compatHeaderEnv := os.Getenv(esCompatHeader)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #864896925ab21dea — Environment-variable access.
pkgs/go/[email protected]/elasticsearch.go:258 
	compatHeaderEnv := os.Getenv(esCompatHeader)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #276d9674b19f5d60 — Environment-variable access.
pkgs/go/[email protected]/elasticsearch.go:512 
	if envURLs, ok := os.LookupEnv("ELASTICSEARCH_URL"); ok && envURLs != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/eric642/e2b-go-sdk

go dependency
expand_more 20 low-confidence finding(s)
low env_fs dependency Excluded from app score #6224a9a52c4a9002 — Environment-variable access.
pkgs/go/[email protected]/config.go:85 
		if v := os.Getenv("E2B_DOMAIN"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c31e19e58102e00 — Environment-variable access.
pkgs/go/[email protected]/config.go:92 
		out.APIKey = os.Getenv("E2B_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6dae4b8d639ba859 — Environment-variable access.
pkgs/go/[email protected]/config.go:95 
		out.AccessToken = os.Getenv("E2B_ACCESS_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #632f4001f58580be — Environment-variable access.
pkgs/go/[email protected]/config.go:98 
		out.Debug = strings.EqualFold(os.Getenv("E2B_DEBUG"), "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0635d7d7046edd4 — Environment-variable access.
pkgs/go/[email protected]/config.go:101 
		if v := os.Getenv("E2B_API_URL"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9211eb295609c4ba — Environment-variable access.
pkgs/go/[email protected]/config.go:110 
		out.SandboxURL = os.Getenv("E2B_SANDBOX_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c3dcc03c04ff9b67 — Environment-variable access.
pkgs/go/[email protected]/examples/basic/main.go:58 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #09dac488e10954f7 — Environment-variable access.
pkgs/go/[email protected]/examples/desktop/main.go:57 
	templateID, ok := os.LookupEnv(templateIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b4d77ce8e5ab5d21 — Environment-variable access.
pkgs/go/[email protected]/examples/desktop/main.go:160 
	if v := os.Getenv("DESKTOP_BROWSER_URL"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e17aeda74e3827d3 — Environment-variable access.
pkgs/go/[email protected]/examples/selfhosted/main.go:30 
		APIKey: os.Getenv("E2B_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #987a24a400c7a759 — Environment-variable access.
pkgs/go/[email protected]/examples/selfhosted/main.go:32 
		APIURL: os.Getenv("E2B_API_URL"), // optional; derived from Domain if empty

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b35faaeb31bbd916 — Environment-variable access.
pkgs/go/[email protected]/examples/selfhosted/main.go:108 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #59f50bb9e14b13cd — Environment-variable access.
pkgs/go/[email protected]/examples/terminal/main.go:32 
		APIKey: os.Getenv("E2B_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #eb3ca965006772a9 — Environment-variable access.
pkgs/go/[email protected]/examples/terminal/main.go:33 
		Domain: os.Getenv("E2B_DOMAIN"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #aaf7ce9e8eec6a6a — Environment-variable access.
pkgs/go/[email protected]/examples/terminal/main.go:34 
		APIURL: os.Getenv("E2B_API_URL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d06872608bee5818 — Environment-variable access.
pkgs/go/[email protected]/examples/terminal/main.go:170 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac29fab0456e393b — Filesystem access.
pkgs/go/[email protected]/template/dockerfile_parser.go:19 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4259503b5fc4b834 — Filesystem access.
pkgs/go/[email protected]/template/hash.go:78 
			data, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8281203f7ca6e984 — Filesystem access.
pkgs/go/[email protected]/template/ignore.go:12 
	data, err := os.ReadFile(filepath.Join(contextDir, ".dockerignore"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53a605b19b685e1a — Filesystem access.
pkgs/go/[email protected]/template/tar.go:101 
	f, err := os.Open(abs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/gin-gonic/gin

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #191133b56522f926 — Filesystem access.
pkgs/go/[email protected]/context.go:621 
	out, err := os.Create(dst)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #681da6d23b4e2216 — Environment-variable access.
pkgs/go/[email protected]/logger.go:227 
	if w, ok := out.(*os.File); !ok || os.Getenv("TERM") == "dumb" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18c058a92f29c38f — Environment-variable access.
pkgs/go/[email protected]/mode.go:52 
	mode := os.Getenv(EnvGinMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2dd7742d36045ac2 — Filesystem access.
pkgs/go/[email protected]/recovery.go:125 
			data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #164a8e1c50a20d89 — Environment-variable access.
pkgs/go/[email protected]/utils.go:143 
		if port := os.Getenv("PORT"); port != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/go-sql-driver/mysql

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #2b7ddd83fe2d10b7 — Filesystem access.
pkgs/go/[email protected]/infile.go:133 
			if file, err = os.Open(name); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/goccy/go-json

go dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #0fb1d030eb7c80ba — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generator/main.go:276 
	return ioutil.WriteFile(path, buf, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36c8d24153fe8154 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generator/main.go:280 
	file, err := ioutil.ReadFile("vm.go.tmpl")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e8346d9cfdcdb0f — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generator/main.go:298 
		if err := ioutil.WriteFile(path, source, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/golang-jwt/jwt/v5

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #11b669fdc87eeb76 — Filesystem access.
pkgs/go/[email protected]/cmd/jwt/main.go:89 
		f, err := os.Open(p)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/gomarkdown/markdown

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #aaa03e07c46e4f07 — Filesystem access.
pkgs/go/github.com_gomarkdown_markdown@v0.0.0-20260614204949-e08cff860f76/cmd/printast/main.go:37 
		d, err := ioutil.ReadFile(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/ledongthuc/pdf

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #c7aa6fe824417b85 — Filesystem access.
pkgs/go/[email protected]/pdfpasswd/main.go:38 
	f, err := os.Open(flag.Arg(0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0007e136498a3ef — Filesystem access.
pkgs/go/[email protected]/read.go:106 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/lib/pq

go dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #ccc0ecb1d5a3f8ba — Environment-variable access.
pkgs/go/[email protected]/conn.go:236 
	filename := os.Getenv("PGPASSFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cd320414674201f — Environment-variable access.
pkgs/go/[email protected]/conn.go:241 
		userHome := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67cdba5841683964 — Filesystem access.
pkgs/go/[email protected]/conn.go:260 
	file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cef7644ec3e5cfc — Environment-variable access.
pkgs/go/[email protected]/connector.go:61 
	for k, v := range parseEnviron(os.Environ()) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0876e2e9bb597237 — Environment-variable access.
pkgs/go/[email protected]/oid/gen.go:31 
	datname := os.Getenv("PGDATABASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb72ee9249073d03 — Environment-variable access.
pkgs/go/[email protected]/oid/gen.go:32 
	sslmode := os.Getenv("PGSSLMODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fccb976232239b96 — Filesystem access.
pkgs/go/[email protected]/oid/gen.go:71 
	f, err := os.Create("types.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff3386e96bb9e5fb — Filesystem access.
pkgs/go/[email protected]/ssl.go:168 
			cert, err = ioutil.ReadFile(sslrootcert)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc72164288880bc5 — Environment-variable access.
pkgs/go/[email protected]/user_posix.go:19 
	name := os.Getenv("USER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/nats-io/nats-server/v2

go dependency
expand_more 76 low-confidence finding(s)
low env_fs dependency Excluded from app score #b975be30ea00ae53 — Filesystem access.
pkgs/go/[email protected]/conf/parse.go:90 
	data, err := os.ReadFile(fp)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8df4b120362c2c9a — Filesystem access.
pkgs/go/[email protected]/conf/parse.go:104 
	data, err := os.ReadFile(fp)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85de7351024cb73b — Environment-variable access.
pkgs/go/[email protected]/conf/parse.go:474 
	if vStr, ok := os.LookupEnv(varReference); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26ec8bca8f56e2d6 — Filesystem access.
pkgs/go/[email protected]/internal/ocsp/ocsp.go:218 
	data, err := os.ReadFile(pemPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #310f47bf8d7305cb — Filesystem access.
pkgs/go/[email protected]/logger/log.go:148 
	f, err := os.OpenFile(filename, fileflags, defaultLogPerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #444d1eba83364177 — Filesystem access.
pkgs/go/[email protected]/logger/log.go:266 
			f, err := os.OpenFile(fname, fileflags, defaultLogPerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bda9372909fe1bdd — Filesystem access.
pkgs/go/[email protected]/server/dirstore.go:180 
			if theJwt, err := os.ReadFile(path); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e72f1a06c5ceaba — Filesystem access.
pkgs/go/[email protected]/server/dirstore.go:246 
			jwtBytes, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dd903fc07416465 — Filesystem access.
pkgs/go/[email protected]/server/dirstore.go:290 
			jwtBytes, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14ed4e79bd110750 — Filesystem access.
pkgs/go/[email protected]/server/dirstore.go:360 
			if theJwt, err := os.ReadFile(path); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22c2b527e99c38ac — Filesystem access.
pkgs/go/[email protected]/server/dirstore.go:403 
	} else if data, err := os.ReadFile(path); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3e9aeaa53e17a35 — Filesystem access.
pkgs/go/[email protected]/server/dirstore.go:444 
	if err := os.WriteFile(path, []byte(theJWT), defaultFilePerms); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1c4ef3b04b0d27c — Filesystem access.
pkgs/go/[email protected]/server/dirstore.go:526 
		} else if existing, err := os.ReadFile(path); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5ce341926b4fbd8 — Filesystem access.
pkgs/go/[email protected]/server/errors_gen.go:160 
	ej, err := os.ReadFile("server/errors.json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da0ebff72285a78a — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:919 
		ekey, err := os.ReadFile(filepath.Join(fs.fcfg.StoreDir, JetStreamMetaFileKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6952d0e5d31fb2f — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:1124 
	ekey, err := os.ReadFile(filepath.Join(mdir, fmt.Sprintf(keyScan, mb.index)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78c813d8a6ce26a7 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:1382 
	ekey, err := os.ReadFile(filepath.Join(mdir, fmt.Sprintf(keyScan, mb.index)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f6dac3117d9d82a — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:1448 
		err = os.WriteFile(mb.mfn, buf, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98ec7076268f8fec — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:1490 
	err = os.WriteFile(mb.mfn, buf, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89362e935d26a685 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:1613 
			fd, err = os.OpenFile(mb.mfn, os.O_RDWR, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9da3002ba965f920 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:1888 
	buf, err := os.ReadFile(fn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dc5e37a54d9881f — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:2119 
	if f, err := os.Open(mdir); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0111b62b0997fef2 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:2171 
	buf, err := os.ReadFile(fn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f345e48d7878a2f — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:2258 
	buf, err := os.ReadFile(fn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69bd36b23bada3c2 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:2382 
	f, err := os.Open(mdir)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9354b3942f3c8ed — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:2414 
	f, err := os.Open(mdir)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6ca2ee1353a0500 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:4817 
	mfd, err := os.OpenFile(mb.mfn, os.O_CREATE|os.O_RDWR, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #541704afcb75a2ec — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:6176 
	err := os.WriteFile(mfn, nbuf, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14bf99a77e68fd92 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:7173 
	mfd, err := os.OpenFile(mb.mfn, os.O_CREATE|os.O_RDWR, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7fcdecce07339af — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:7568 
	origBuf, err := os.ReadFile(mb.mfn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f87aaf90bd758059 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:7624 
	tmpFD, err := os.OpenFile(tmpFN, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cc3cd1579e42766 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:7873 
				fd, err = os.OpenFile(mb.mfn, os.O_RDWR, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b41e8cf0b5537644 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:7922 
		fd, err = os.OpenFile(fn, os.O_RDWR, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f40b1ce3a715df3b — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:8397 
	f, err := os.Open(mb.mfn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e544c270279dedb0 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:9654 
	buf, err := os.ReadFile(ifn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a23e2145c2b34852 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:10536 
			err = os.WriteFile(mfn, nbuf, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c955288bea0589f — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:11941 
	err := os.WriteFile(fn, buf, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ccf93422eb5902d — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:12190 
		if buf, err := os.ReadFile(sfn); err == nil && len(buf) >= minLen {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72997fa0da639945 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:12605 
		if ekey, err := os.ReadFile(filepath.Join(odir, JetStreamMetaFileKey)); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8675b058707f919f — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:12662 
			if buf, err := os.ReadFile(o.ifn); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc22a21e7909bbb1 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:12702 
	ekey, err := os.ReadFile(filepath.Join(odir, JetStreamMetaFileKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80ff3f168b0028d9 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:12736 
	buf, err := os.ReadFile(o.ifn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81081894bbce54b4 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:13406 
	buf, err := os.ReadFile(o.ifn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbc53795468486f1 — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:13830 
	f, err := os.OpenFile(tmp, flags, perm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed4918a966628c3b — Filesystem access.
pkgs/go/[email protected]/server/filestore.go:13852 
		if d, err = os.Open(filepath.Dir(name)); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fee41a720ca3e8ba — Filesystem access.
pkgs/go/[email protected]/server/jetstream.go:1263 
			buf, err := os.ReadFile(metafile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e321d9227465b0f — Filesystem access.
pkgs/go/[email protected]/server/jetstream.go:1274 
			if key, err := os.ReadFile(filepath.Join(odir, ofi.Name(), JetStreamMetaFileKey)); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0dcc02c20c26bd3 — Filesystem access.
pkgs/go/[email protected]/server/jetstream.go:1389 
		buf, err := os.ReadFile(metafile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bd295f9a0f301c3 — Filesystem access.
pkgs/go/[email protected]/server/jetstream.go:1398 
		sum, err := os.ReadFile(metasum)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a5523a0bb253411 — Filesystem access.
pkgs/go/[email protected]/server/jetstream.go:1416 
		keyBuf, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09062e50bccd93a2 — Filesystem access.
pkgs/go/[email protected]/server/jetstream.go:1539 
				err := os.WriteFile(keyFile, keyBuf, defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c9d784fe710e914 — Filesystem access.
pkgs/go/[email protected]/server/jwt.go:38 
	contents, err := os.ReadFile(jwtfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f6839883212781c — Filesystem access.
pkgs/go/[email protected]/server/leafnode.go:172 
			contents, err := os.ReadFile(creds)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a3e9771d7305709 — Filesystem access.
pkgs/go/[email protected]/server/leafnode.go:1097 
		contents, err := os.ReadFile(creds)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de02940906cd1c59 — Filesystem access.
pkgs/go/[email protected]/server/ocsp.go:137 
	raw, err := os.ReadFile(filepath.Join(storeDir, defaultOCSPStoreDir, key))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1e1378778a77ef6 — Filesystem access.
pkgs/go/[email protected]/server/ocsp.go:873 
	data, err := os.ReadFile(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6145a4540e161b4 — Filesystem access.
pkgs/go/[email protected]/server/ocsp_responsecache.go:386 
	dat, err := os.ReadFile(store)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4335a8b59c5dcca7 — Filesystem access.
pkgs/go/[email protected]/server/opts.go:5805 
		rootPEM, err := os.ReadFile(tc.CaFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19a97c96b00b9d13 — Filesystem access.
pkgs/go/[email protected]/server/opts.go:6511 
	if b, err := os.ReadFile(pidStr); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f5757a585bf7786 — Environment-variable access.
pkgs/go/[email protected]/server/opts.go:6519 
		homeDrive, homePath := os.Getenv("HOMEDRIVE"), os.Getenv("HOMEPATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #480c50c47599950d — Environment-variable access.
pkgs/go/[email protected]/server/opts.go:6520 
		userProfile := os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73e42253f6be480c — Environment-variable access.
pkgs/go/[email protected]/server/opts.go:6533 
	home := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e41d1ac5a8cbf145 — Filesystem access.
pkgs/go/[email protected]/server/pse/pse_linux.go:52 
	contents, err := os.ReadFile(procStatFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e00a3b8642305f7 — Filesystem access.
pkgs/go/[email protected]/server/pse/pse_linux.go:92 
	contents, err := os.ReadFile(procStatFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f25a9768c0dea74e — Filesystem access.
pkgs/go/[email protected]/server/raft.go:1746 
	buf, err := os.ReadFile(n.snapfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #824cde49f3af31e0 — Filesystem access.
pkgs/go/[email protected]/server/raft.go:4990 
	buf, err := os.ReadFile(filepath.Join(sd, peerStateFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b47a3a96ba99b009 — Filesystem access.
pkgs/go/[email protected]/server/raft.go:5016 
	buf, err := os.ReadFile(filepath.Join(n.sd, termVoteFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #079031a4853792e1 — Filesystem access.
pkgs/go/[email protected]/server/server.go:1690 
	return os.WriteFile(s.getOpts().PidFile, []byte(pidStr), defaultFilePerms)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81409ee06758d088 — Filesystem access.
pkgs/go/[email protected]/server/server.go:4342 
			if err := os.WriteFile(portsFile, data, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #294bec7ba1985392 — Environment-variable access.
pkgs/go/[email protected]/server/service_windows.go:47 
	if v, exists := os.LookupEnv("NATS_DOCKERIZED"); exists && v == "1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62ff1ce6070cb463 — Environment-variable access.
pkgs/go/[email protected]/server/service_windows.go:70 
	if v, exists := os.LookupEnv("NATS_STARTUP_DELAY"); exists {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cca5b2ab92b5690 — Filesystem access.
pkgs/go/[email protected]/server/stream.go:9101 
		fd, err := os.OpenFile(fpath, os.O_CREATE|os.O_RDWR, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8390d075fc7212a3 — Filesystem access.
pkgs/go/[email protected]/server/stream.go:9115 
	b, err := os.ReadFile(filepath.Join(sdir, JetStreamMetaFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c0692314b5c8d59 — Filesystem access.
pkgs/go/[email protected]/server/stream.go:9174 
		buf, err := os.ReadFile(metafile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cccef514bf820e12 — Filesystem access.
pkgs/go/[email protected]/server/tpm/js_ek_tpm_windows.go:107 
	if err := os.WriteFile(filename, keysJSON, 0640); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #670495234c86b453 — Filesystem access.
pkgs/go/[email protected]/server/tpm/js_ek_tpm_windows.go:116 
	keysJSON, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/nats-io/nats.go

go dependency
expand_more 12 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #e5f8874b32700c8a — Filesystem access.
pkgs/go/[email protected]/examples/nats-bench/main.go:147 
		os.WriteFile(*csvFile, []byte(csv), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4932f4476d6521e0 — Environment-variable access.
pkgs/go/[email protected]/examples/nats-echo/main.go:201 
	url := os.Getenv("ECHO_SVC_GEO_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9bc07b0fabaceaf — Filesystem access.
pkgs/go/[email protected]/jetstream/object.go:1130 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a1f2f95f54c1d0d — Filesystem access.
pkgs/go/[email protected]/jetstream/object.go:1141 
	f, err := os.OpenFile(file, os.O_WRONLY|os.O_CREATE, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1b1edb6102b2f34 — Filesystem access.
pkgs/go/[email protected]/nats.go:1066 
				rootPEM, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b62f7b29db3fbac5 — Filesystem access.
pkgs/go/[email protected]/nats.go:6624 
	contents, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b17b8ed9fef3c32 — Environment-variable access.
pkgs/go/[email protected]/nats.go:6634 
		homeDrive, homePath := os.Getenv("HOMEDRIVE"), os.Getenv("HOMEPATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1a6ada6f156a54a — Environment-variable access.
pkgs/go/[email protected]/nats.go:6635 
		userProfile := os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b7d1149c5cfc07f — Environment-variable access.
pkgs/go/[email protected]/nats.go:6650 
	home := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #625618f36add04a2 — Filesystem access.
pkgs/go/[email protected]/nats.go:6673 
	contents, err := os.ReadFile(seedFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36f69d29aff2432c — Filesystem access.
pkgs/go/[email protected]/object.go:885 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c421d69ae4c4d69c — Filesystem access.
pkgs/go/[email protected]/object.go:896 
	f, err := os.OpenFile(file, os.O_WRONLY|os.O_CREATE, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • dashscope prod — no sdist (wheels only)
  • infinity-sdk prod — sdist exceeds byte cap
  • onnxruntime prod — no sdist (wheels only)
  • onnxruntime-gpu prod — no sdist (wheels only)
  • opencv-python prod — sdist exceeds byte cap
  • opencv-python-headless prod — sdist exceeds byte cap
  • spacy prod — no sdist (wheels only)
  • en-core-web-sm prod — pypi 404
  • selenium-wire prod — sdist exceeds byte cap
  • sqlglotrs prod — no python source in sdist
  • word2number prod — extract failed: not a gzip file
  • github.com/infiniflow/infinity-go-sdk prod — proxy 404
  • github.com/nikolalohinski/gonja prod — scan budget exceeded
  • github.com/peterh/liner prod — scan budget exceeded
  • github.com/pkoukk/tiktoken-go prod — scan budget exceeded
  • github.com/redis/go-redis/v9 prod — scan budget exceeded
  • github.com/signintech/gopdf prod — scan budget exceeded
  • github.com/siongui/gojianfan prod — scan budget exceeded
  • github.com/spf13/viper prod — scan budget exceeded
  • github.com/xuri/excelize/v2 prod — scan budget exceeded
  • github.com/yfedoseev/office_oxide/go prod — scan budget exceeded
  • github.com/yfedoseev/pdf_oxide/go prod — scan budget exceeded
  • github.com/zeebo/xxh3 prod — scan budget exceeded
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp prod — scan budget exceeded
  • go.opentelemetry.io/otel prod — scan budget exceeded
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace prod — scan budget exceeded
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp prod — scan budget exceeded
  • go.opentelemetry.io/otel/sdk prod — scan budget exceeded
  • go.opentelemetry.io/otel/trace prod — scan budget exceeded
  • go.uber.org/zap prod — scan budget exceeded
  • golang.org/x/crypto prod — scan budget exceeded
  • golang.org/x/net prod — scan budget exceeded
  • golang.org/x/sync prod — scan budget exceeded
  • golang.org/x/term prod — scan budget exceeded
  • golang.org/x/text prod — scan budget exceeded
  • google.golang.org/api prod — scan budget exceeded
  • google.golang.org/genai prod — scan budget exceeded
  • gopkg.in/natefinch/lumberjack.v2 prod — scan budget exceeded
  • gopkg.in/yaml.v3 prod — scan budget exceeded
  • gorm.io/driver/mysql prod — scan budget exceeded
  • gorm.io/gorm prod — scan budget exceeded