Close Open Privacy Scan
App Privacy Score
Low risk · 233 finding(s)
Based on: 1 first-party package(s) · 4/6 deps analyzed
Dependency score: 82 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
687fb701029421ae5549d998--8000.hf.jobsapi-inference.huggingface.coapi.cerebras.aiapi.cohere.comapi.deepinfra.comapi.endpoints.huggingface.cloudapi.featherless.aiapi.fireworks.aiapi.github.comapi.groq.comapi.novita.aiapi.openai.comapi.publicai.coapi.replicate.comapi.scaleway.aiapi.slack.comapi.telegram.orgapi.together.xyzapi.wavespeed.aiapi.z.aiarxiv.orgcdn.britannica.comconsoledonottrack.comcoqui.aicore.telegram.orgdatasets-server.huggingface.codeveloper.mozilla.orgdiscord.comdiscordpy.readthedocs.iodocs.github.comdocs.microsoft.comdocs.python.orgendpoints.huggingface.cofal.runfate.ffmpeg.orgffmpeg.orgfilesystem-spec.readthedocs.ioformulae.brew.shgit-scm.comgithub.comhf.cohub-ci.huggingface.cohub.my-company.comhuggingface.coinference.api.nscale.comipywidgets.readthedocs.iojson-schema.orgjzgu0buei5.us-east-1.aws.endpoints.huggingface.cloudkeras.iomy-text-to-image.region.vendor.endpoints.huggingface.cloudndjson.orgnew-url.comnew.webhook.siteoai.endpoints.kepler.ai.cloud.ovh.netopennmt.netplatform.openai.compyav.orgpypi.orgpytorch.orgqueue.fal.runraw.githubusercontent.comrequests.readthedocs.iorouter.huggingface.costackoverflow.comtldp.orgtqdm.github.ioupload.wikimedia.orgwebhook.sitewww.brynosaurus.comwww.ffmpeg.orgwww.google.comwww.ietf.orgwww.python-httpx.orgwww.scivision.devwww.w3.org
</> First-Party Code
first-party (python)
python first-partyexpand_more 6 low-confidence finding(s)
low env_fs — Filesystem access. 6 locations
</> Dependencies
av
python dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
response = urlopen(url)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
huggingface_hub
python dependencyexpand_more 185 low-confidence finding(s)
low env_fs — Filesystem access. 64 locations
low env_fs — Environment-variable access. 57 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 62 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
tokenizers
python dependencyexpand_more 12 low-confidence finding(s)
os.environ["RAYON_NUM_THREADS"] = str(num_threads)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Filesystem access. 10 locations
response = get(args.model, allow_redirects=True)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
tqdm
python dependencyexpand_more 20 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low env_fs — Environment-variable access. 5 locations
Skipped dependencies
Production
- ctranslate2 prod — no sdist (wheels only)
- onnxruntime prod — no sdist (wheels only)