Close Open Privacy Scan

link https://github.com/milvus-io/milvus
bolt Snapshot: commit 88f357a
science engine v3
schedule 2026-07-11T00:12:03.201697+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

App Privacy Score

97 /100
Low privacy risk

Low risk · 1176 finding(s)

Dependency score: 57 (Medium risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 2 medium 1174 low
First-party packages: 5
Dependency packages: 57
Ecosystem: go

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)
medium google.golang.org/protobuf dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:520 → pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:523

</> First-Party Code

first-party (go)

go first-party
expand_more 75 low-confidence finding(s)
low env_fs production #35c25d3339d88815 — Filesystem access.
repo/client/milvusclient/tls.go:30 
	caPem, err := os.ReadFile(caPemPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ba5c091a56b769ae — Filesystem access.
repo/cmd/components/util.go:125 
		f, err := os.Create(p.filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d3c46b4887feafb — Filesystem access.
repo/cmd/milvus/stop.go:64 
	fd, err := os.OpenFile(path.Join(runtimeDir, filename), os.O_RDONLY, 0o664)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b1a4efb6ab6432d5 — Filesystem access.
repo/cmd/milvus/util.go:79 
	fd, err := os.OpenFile(fileFullName, os.O_CREATE|os.O_RDWR, 0o664)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6706d84cf56e64f3 — Environment-variable access.
repo/cmd/roles/roles.go:178 
	val, ok := os.LookupEnv(LDPreLoad)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0310afcf6f4139f5 — Environment-variable access.
repo/cmd/tools/config-docs-generator/main.go:17 
	outputPath = os.Getenv("PWD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #26985464793ec6e5 — Filesystem access.
repo/cmd/tools/config-docs-generator/main.go:33 
	data, err := os.ReadFile(inputFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be31a02c9a961286 — Filesystem access.
repo/cmd/tools/config-docs-generator/main.go:177 
		os.WriteFile(filepath.Join(outputPath, sec.fileName()), []byte(sectionFileContent), 0o600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6f7107df7288ca2 — Filesystem access.
repo/cmd/tools/config-docs-generator/main.go:179 
	err := os.WriteFile(filepath.Join(outputPath, fileName), []byte(fileContent), 0o600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a20e0de5d3de56ce — Filesystem access.
repo/cmd/tools/config/main.go:26 
		f, err := os.Create("configs.csv")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9969d80050f48561 — Filesystem access.
repo/cmd/tools/config/main.go:34 
		f, err := os.Create("milvus.yaml")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a12e318bd29d48bf — Filesystem access.
repo/cmd/tools/config/printer.go:15 
	data, err := os.ReadFile(filepath) //nolint:gosec // filepath is from CLI args, not untrusted input

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb62368d1505ff9a — Environment-variable access.
repo/examples/telemetry_demo/main.go:742 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #46e80dd90e18b012 — Environment-variable access.
repo/examples/telemetry_demo/multi_database_demo.go:627 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3626018f0da5ce1c — Environment-variable access.
repo/examples/telemetry_e2e_test/main.go:45 
	address := os.Getenv("MILVUS_ADDRESS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0144089ff4b7374c — Environment-variable access.
repo/internal/distributed/proxy/service.go:1121 
	buildTags := os.Getenv(metricsinfo.GitBuildTagsEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7e4f26e2c78221c — Filesystem access.
repo/internal/distributed/utils/util.go:70 
	b, err := os.ReadFile(caFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #34550da7035fdb05 — Environment-variable access.
repo/internal/http/server.go:312 
	port := os.Getenv(ListenPortEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6d0977fbf82f5246 — Filesystem access.
repo/internal/proxy/accesslog/chown_linux.go:12 
	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d421f1a14f5de962 — Filesystem access.
repo/internal/proxy/accesslog/writer.go:273 
	file, err := os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f09bffa8626ae80d — Filesystem access.
repo/internal/proxy/accesslog/writer.go:309 
	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #80d3554df3fa43c7 — Environment-variable access.
repo/internal/proxy/impl.go:4531 
		Status: merr.Success(os.Getenv(metricsinfo.DeployModeEnvKey)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #319c692d737cf063 — Environment-variable access.
repo/internal/proxy/impl.go:6342 
		BuildTags:  os.Getenv(metricsinfo.GitBuildTagsEnvKey),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1e541b24fc86f843 — Environment-variable access.
repo/internal/proxy/impl.go:6343 
		BuildTime:  os.Getenv(metricsinfo.MilvusBuildTimeEnvKey),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc0f980ce19a86c2 — Environment-variable access.
repo/internal/proxy/impl.go:6344 
		GitCommit:  os.Getenv(metricsinfo.GitCommitEnvKey),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a967b992d342fd2 — Environment-variable access.
repo/internal/proxy/impl.go:6345 
		GoVersion:  os.Getenv(metricsinfo.MilvusUsedGoVersion),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9ed3fa1f065d83af — Environment-variable access.
repo/internal/proxy/impl.go:6346 
		DeployMode: os.Getenv(metricsinfo.DeployModeEnvKey),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9008c62f2bb70028 — Filesystem access.
repo/internal/querynodev2/delegator/idf_oracle.go:301 
			f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #80c140fdc32ecef9 — Filesystem access.
repo/internal/querynodev2/delegator/idf_oracle.go:772 
	f, err := os.Create(localPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f66f849ef25b7eaa — Filesystem access.
repo/internal/storage/local_chunk_manager.go:310 
	dstFile, err := os.Create(dstFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c5d89cd860cdaf0b — Filesystem access.
repo/internal/storage/print_binlog.go:47 
	fd, err := os.OpenFile(filename, os.O_RDONLY, 0o400)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ebd5d6a4ea05ab32 — Filesystem access.
repo/internal/storage/utils.go:55 
	reader, err := os.Open(filepath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #28c145e6ac0e6e97 — Filesystem access.
repo/internal/storage/utils.go:69 
	data, err := os.ReadFile(filepath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b34dc0dbaa687c47 — Filesystem access.
repo/internal/storage/utils.go:83 
	err := os.WriteFile(filepath, data, perm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #59207239f4568b54 — Filesystem access.
repo/internal/util/fileresource/manager.go:200 
			file, err := os.Create(localFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #58d8af2a6e150e39 — Filesystem access.
repo/internal/util/fileresource/manager.go:312 
			file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ef660548c4792c1 — Environment-variable access.
repo/internal/util/function/embedding/bedrock_embedding_provider.go:107 
		awsAccessKeyId = os.Getenv(models.BedrockAccessKeyId)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa2cac1345abbf9e — Environment-variable access.
repo/internal/util/function/embedding/bedrock_embedding_provider.go:110 
		awsSecretAccessKey = os.Getenv(models.BedrockSAKEnvStr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e3bebe71b35cf7ab — Environment-variable access.
repo/internal/util/function/embedding/openai_embedding_provider.go:68 
			resourceName = os.Getenv(models.AzureOpenaiResourceName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e33c33def443d51 — Environment-variable access.
repo/internal/util/function/embedding/vertexai_embedding_provider.go:49 
	jsonKeyPath := os.Getenv(models.VertexServiceAccountJSONEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0802e16eb3f44d55 — Filesystem access.
repo/internal/util/function/embedding/vertexai_embedding_provider.go:57 
	jsonKey, err := os.ReadFile(jsonKeyPath) //nolint:gosec // path is from trusted environment variable

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #855cdda5952ba941 — Environment-variable access.
repo/internal/util/function/models/common.go:210 
		apiKey = os.Getenv(apiKeyEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5d39069a59654ea7 — Environment-variable access.
repo/internal/util/function/models/common.go:217 
		apiKey = os.Getenv(newEnvStr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09e07ee995d5b790 — Filesystem access.
repo/internal/util/metrics/thread.go:190 
		nameBytes, err := os.ReadFile(filepath.Join(taskDir, entry.Name(), "comm"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f7739b23b2b275e — Filesystem access.
repo/internal/util/metrics/thread.go:194 
		statBytes, err := os.ReadFile(filepath.Join(taskDir, entry.Name(), "stat"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72df200bbe1010d6 — Environment-variable access.
repo/internal/util/sessionutil/labels.go:69 
	for _, value := range os.Environ() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bf632336272e9aeb — Environment-variable access.
repo/internal/util/sessionutil/session_util.go:423 
	if os.Getenv(MilvusNodeIDForTesting) != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f9f5bd408cd2d67e — Environment-variable access.
repo/internal/util/sessionutil/session_util.go:424 
		mlog.Info(context.TODO(), "use node id for testing", mlog.String("nodeID", os.Getenv(MilvusNodeIDForTesting)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3414c67c02722e32 — Environment-variable access.
repo/internal/util/sessionutil/session_util.go:425 
		return strconv.ParseInt(os.Getenv(MilvusNodeIDForTesting), 10, 64)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9b43fb448749034d — Filesystem access.
repo/internal/util/sessionutil/session_util.go:1204 
	fd, err := os.OpenFile(fileFullPath, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0o664)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da2e70b2780a4a79 — Environment-variable access.
repo/internal/util/streamingutil/env.go:12 
	return os.Getenv(MilvusStreamingServiceEnabled) == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #249b44943163792f — Environment-variable access.
repo/pkg/config/env_source.go:43 
	for _, value := range os.Environ() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36efc261bb78b2dc — Filesystem access.
repo/pkg/config/file_source.go:140 
		data, err := os.ReadFile(configFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2b6541bf763023f — Environment-variable access.
repo/pkg/objectstorage/huawei/huawei.go:116 
	regionName := os.Getenv("HUAWEICLOUD_SDK_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f67321f469f7d50 — Environment-variable access.
repo/pkg/objectstorage/util.go:199 
		if os.Getenv("AZURE_FEDERATED_TOKEN_FILE") != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93582dbd4d0f4d6d — Environment-variable access.
repo/pkg/objectstorage/util.go:201 
				ClientID:      os.Getenv("AZURE_CLIENT_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8f30ee04a7044a58 — Environment-variable access.
repo/pkg/objectstorage/util.go:202 
				TenantID:      os.Getenv("AZURE_TENANT_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f4ae18702a3e6a3d — Environment-variable access.
repo/pkg/objectstorage/util.go:203 
				TokenFilePath: os.Getenv("AZURE_FEDERATED_TOKEN_FILE"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fcb92667f858b5ca — Environment-variable access.
repo/pkg/objectstorage/util.go:206 
			clientID := os.Getenv("AZURE_CLIENT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18ab28a22deb5d5b — Environment-variable access.
repo/pkg/objectstorage/util.go:222 
		connectionString := os.Getenv("AZURE_STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be8fb8d8b9bba824 — Filesystem access.
repo/pkg/streaming/util/message/codegen/main.go:359 
	jsonData, err := os.ReadFile(reflectInfoFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32ae7fc37a6fbd54 — Filesystem access.
repo/pkg/streaming/util/message/codegen/main.go:380 
	err = os.WriteFile(reflectInfoGo, []byte(code), 0o644) // #nosec G306

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #902a36fcbd667eea — Filesystem access.
repo/pkg/util/etcd/etcd_util.go:174 
	caCert, err := os.ReadFile(caCertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc2a7f779516e6b5 — Environment-variable access.
repo/pkg/util/gc/gc_tuner.go:110 
		if envGOGC := os.Getenv("GOGC"); envGOGC != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f81926922afaf12d — Environment-variable access.
repo/pkg/util/hardware/container_linux.go:63 
	memoryStr := os.Getenv("MEM_LIMIT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5cb23d5e75d32923 — Environment-variable access.
repo/pkg/util/hardware/container_test_linux.go:55 
		assert.Equal(t, "", os.Getenv("MEM_LIMIT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d572afeed2fdd89e — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:34 
	m.SystemVersion = os.Getenv(GitCommitEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c8c0459468bd9ab8 — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:35 
	m.DeployMode = os.Getenv(DeployModeEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a7c8751688a0cc0a — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:36 
	m.BuildVersion = os.Getenv(GitBuildTagsEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8922245c21c1df4d — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:37 
	m.UsedGoVersion = os.Getenv(MilvusUsedGoVersion)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed92fe802580b71c — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:38 
	m.BuildTime = os.Getenv(MilvusBuildTimeEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9be60206f32bc52a — Environment-variable access.
repo/pkg/util/paramtable/base_table.go:237 
	configDir := os.Getenv("MILVUSCONF")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a7e6af0ec32e196 — Environment-variable access.
repo/pkg/util/paramtable/component_param.go:7123 
	if os.Getenv(metricsinfo.DeployModeEnvKey) == metricsinfo.StandaloneDeployMode {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b27b2a7a831030cc — Environment-variable access.
repo/pkg/util/paramtable/runtime.go:47 
		if refreshInterval := os.Getenv(MilvusConfigRefreshIntervalEnvKey); refreshInterval != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65c69cb9c7631539 — Environment-variable access.
repo/pkg/util/paramtable/service_param.go:145 
	if p.UseEmbedEtcd.GetAsBool() && (os.Getenv(metricsinfo.DeployModeEnvKey) != metricsinfo.StandaloneDeployMode) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (go): client

go first-party
expand_more 1 low-confidence finding(s)
low env_fs production #35c25d3339d88815 — Filesystem access.
repo/client/milvusclient/tls.go:30 
	caPem, err := os.ReadFile(caPemPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (go): examples/telemetry_demo

go first-party
expand_more 2 low-confidence finding(s)
low env_fs production #bb62368d1505ff9a — Environment-variable access.
repo/examples/telemetry_demo/main.go:742 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #46e80dd90e18b012 — Environment-variable access.
repo/examples/telemetry_demo/multi_database_demo.go:627 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (go): examples/telemetry_e2e_test

go first-party
expand_more 1 low-confidence finding(s)
low env_fs production #3626018f0da5ce1c — Environment-variable access.
repo/examples/telemetry_e2e_test/main.go:45 
	address := os.Getenv("MILVUS_ADDRESS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (go): pkg

go first-party
expand_more 24 low-confidence finding(s)
low env_fs production #249b44943163792f — Environment-variable access.
repo/pkg/config/env_source.go:43 
	for _, value := range os.Environ() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36efc261bb78b2dc — Filesystem access.
repo/pkg/config/file_source.go:140 
		data, err := os.ReadFile(configFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2b6541bf763023f — Environment-variable access.
repo/pkg/objectstorage/huawei/huawei.go:116 
	regionName := os.Getenv("HUAWEICLOUD_SDK_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f67321f469f7d50 — Environment-variable access.
repo/pkg/objectstorage/util.go:199 
		if os.Getenv("AZURE_FEDERATED_TOKEN_FILE") != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93582dbd4d0f4d6d — Environment-variable access.
repo/pkg/objectstorage/util.go:201 
				ClientID:      os.Getenv("AZURE_CLIENT_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8f30ee04a7044a58 — Environment-variable access.
repo/pkg/objectstorage/util.go:202 
				TenantID:      os.Getenv("AZURE_TENANT_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f4ae18702a3e6a3d — Environment-variable access.
repo/pkg/objectstorage/util.go:203 
				TokenFilePath: os.Getenv("AZURE_FEDERATED_TOKEN_FILE"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fcb92667f858b5ca — Environment-variable access.
repo/pkg/objectstorage/util.go:206 
			clientID := os.Getenv("AZURE_CLIENT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18ab28a22deb5d5b — Environment-variable access.
repo/pkg/objectstorage/util.go:222 
		connectionString := os.Getenv("AZURE_STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be8fb8d8b9bba824 — Filesystem access.
repo/pkg/streaming/util/message/codegen/main.go:359 
	jsonData, err := os.ReadFile(reflectInfoFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32ae7fc37a6fbd54 — Filesystem access.
repo/pkg/streaming/util/message/codegen/main.go:380 
	err = os.WriteFile(reflectInfoGo, []byte(code), 0o644) // #nosec G306

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #902a36fcbd667eea — Filesystem access.
repo/pkg/util/etcd/etcd_util.go:174 
	caCert, err := os.ReadFile(caCertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc2a7f779516e6b5 — Environment-variable access.
repo/pkg/util/gc/gc_tuner.go:110 
		if envGOGC := os.Getenv("GOGC"); envGOGC != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f81926922afaf12d — Environment-variable access.
repo/pkg/util/hardware/container_linux.go:63 
	memoryStr := os.Getenv("MEM_LIMIT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5cb23d5e75d32923 — Environment-variable access.
repo/pkg/util/hardware/container_test_linux.go:55 
		assert.Equal(t, "", os.Getenv("MEM_LIMIT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d572afeed2fdd89e — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:34 
	m.SystemVersion = os.Getenv(GitCommitEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c8c0459468bd9ab8 — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:35 
	m.DeployMode = os.Getenv(DeployModeEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a7c8751688a0cc0a — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:36 
	m.BuildVersion = os.Getenv(GitBuildTagsEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8922245c21c1df4d — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:37 
	m.UsedGoVersion = os.Getenv(MilvusUsedGoVersion)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed92fe802580b71c — Environment-variable access.
repo/pkg/util/metricsinfo/utils.go:38 
	m.BuildTime = os.Getenv(MilvusBuildTimeEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9be60206f32bc52a — Environment-variable access.
repo/pkg/util/paramtable/base_table.go:237 
	configDir := os.Getenv("MILVUSCONF")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a7e6af0ec32e196 — Environment-variable access.
repo/pkg/util/paramtable/component_param.go:7123 
	if os.Getenv(metricsinfo.DeployModeEnvKey) == metricsinfo.StandaloneDeployMode {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b27b2a7a831030cc — Environment-variable access.
repo/pkg/util/paramtable/runtime.go:47 
		if refreshInterval := os.Getenv(MilvusConfigRefreshIntervalEnvKey); refreshInterval != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65c69cb9c7631539 — Environment-variable access.
repo/pkg/util/paramtable/service_param.go:145 
	if p.UseEmbedEtcd.GetAsBool() && (os.Getenv(metricsinfo.DeployModeEnvKey) != metricsinfo.StandaloneDeployMode) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

github.com/cockroachdb/errors

go dependency
medium telemetry dependency Excluded from app score #2845a59b84077a15 — Telemetry/analytics SDK call. This library transmits usage or event data to a third-party service.
pkgs/go/[email protected]/report/report.go:380 
	res := sentry.CaptureEvent(event)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #8cb339733e353d66 — Filesystem access.
pkgs/go/[email protected]/testutils/simplecheck.go:208 
		data, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google.golang.org/protobuf

go dependency
medium pii_flow dependency Excluded from app score #7379627af0ed1984 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:523 · flow /tmp/closeopen-_oexzo5a/pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:520 → /tmp/closeopen-_oexzo5a/pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:523 
		fmt.Printf("executing: %v\n%s\n", strings.Join(cmd.Args, " "), out)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 22 low-confidence finding(s)
low env_fs dependency Excluded from app score #bf64f146706a9e1b — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:117 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/wirefuzz/corpus/%x", sha1.Sum(wire)), wire, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b27f014b9529558 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:125 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/textfuzz/corpus/%x", sha1.Sum(text)), text, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #551f357418712031 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:133 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/jsonfuzz/corpus/%x", sha1.Sum(json)), json, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3870f74c2f527a7e — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:46 
	if plugin := os.Getenv("RUN_AS_PROTOC_PLUGIN"); plugin != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0dd074dcd44f8a2 — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:85 
	flag.StringVar(&protoRoot, "protoroot", os.Getenv("PROTOBUF_ROOT"), "The root of the protobuf source tree.")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #606ab4dd9db787a8 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:119 
	out, err := os.Create(outFn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a9e6dde93a61548 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:124 
	b, err := os.ReadFile(inFn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81fab471c5ee98d9 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:427 
			check(os.WriteFile(filepath.Join(tmpDir, filepath.FromSlash(d.path+"/gen_test.go")), b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d1d1a8589135508 — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:520 
	cmd.Env = append(os.Environ(), "RUN_AS_PROTOC_PLUGIN=1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0bb662995101487 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:721 
	src, err := os.ReadFile(srcPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d43ebdd324294fc — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:724 
	dst, _ := os.ReadFile(dstPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ef79aa2b622c3fd — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:728 
	check(os.WriteFile(dstPath, src, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df087022530be615 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:263 
		prev, _ := os.ReadFile(absFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffcad887c4a360f3 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:266 
			check(os.WriteFile(absFile, b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12ba0cbc2307ac27 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:269 
		check(os.WriteFile(absFile+".tmp", b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fca14023fe73291d — Filesystem access.
pkgs/go/[email protected]/internal/cmd/pbdump/pbdump.go:121 
		b, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #102199d48be65c92 — Filesystem access.
pkgs/go/[email protected]/internal/detrand/rand.go:46 
	f, err := os.Open(s)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a1139736f205940 — Filesystem access.
pkgs/go/[email protected]/internal/fuzztest/fuzztest.go:20 
	dir, err := os.Open(*corpus)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1386784f6210c0d1 — Filesystem access.
pkgs/go/[email protected]/internal/fuzztest/fuzztest.go:36 
			b, err := os.ReadFile(filepath.Join(*corpus, name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fd32f758b9576a2 — Environment-variable access.
pkgs/go/[email protected]/internal/impl/lazy.go:24 
	if os.Getenv("GOPROTODEBUG") == "nolazy" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fcba8dd56b50e92 — Environment-variable access.
pkgs/go/[email protected]/reflect/protoregistry/registry.go:51 
	if v := os.Getenv(env); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #430ea9c787a7de8d — Environment-variable access.
pkgs/go/[email protected]/reflect/protoregistry/registry.go:63 
		panic("invalid " + env + " value: " + os.Getenv(env))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cloud.google.com/go/storage

go dependency
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #51b5c5a08abaa31e — Environment-variable access.
pkgs/go/[email protected]/grpc_client.go:93 
	if host := os.Getenv("STORAGE_EMULATOR_HOST_GRPC"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57b7441e53b3d751 — Environment-variable access.
pkgs/go/[email protected]/http_client.go:76 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ee604ef1b7091a8 — Environment-variable access.
pkgs/go/[email protected]/option.go:49 
	increaseRate := os.Getenv(dynamicReadReqIncreaseRateEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4ef8c87c6e50613 — Environment-variable access.
pkgs/go/[email protected]/option.go:64 
	initialTimeout := os.Getenv(dynamicReadReqInitialTimeoutEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22ebfdb1b116633e — Environment-variable access.
pkgs/go/[email protected]/storage.go:146 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #084c9363680ecb51 — Environment-variable access.
pkgs/go/[email protected]/storage.go:352 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c1236039ac1fc1f — Environment-variable access.
pkgs/go/[email protected]/storage.go:364 
	if host := os.Getenv("STORAGE_EMULATOR_HOST"); host != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b7fda6d3da6b9aa — Filesystem access.
pkgs/go/[email protected]/transfermanager/downloader.go:202 
		f, fErr := os.Create(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/Azure/azure-sdk-for-go/sdk/azcore

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #8180715736cc0703 — Environment-variable access.
pkgs/go/[email protected]/runtime/policy_telemetry.go:78 
		operatingSystem = os.Getenv("OS") // Get more specific OS information

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/Azure/azure-sdk-for-go/sdk/azidentity

go dependency
expand_more 36 low-confidence finding(s)
low env_fs dependency Excluded from app score #48aa49fc82252758 — Environment-variable access.
pkgs/go/[email protected]/azidentity.go:70 
		if envAuthorityHost := os.Getenv(azureAuthorityHost); envAuthorityHost != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f5137e6bc59bfdf — Environment-variable access.
pkgs/go/[email protected]/azure_cli_credential.go:134 
		dir := os.Getenv("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #250664c75d4036e6 — Environment-variable access.
pkgs/go/[email protected]/azure_cli_credential.go:144 
	cliCmd.Env = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31d8f36b63cfc0d2 — Environment-variable access.
pkgs/go/[email protected]/azure_developer_cli_credential.go:120 
		dir := os.Getenv("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b357e83207b6180f — Environment-variable access.
pkgs/go/[email protected]/azure_developer_cli_credential.go:130 
	cliCmd.Env = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #542424291e874b10 — Environment-variable access.
pkgs/go/[email protected]/azure_pipelines_credential.go:61 
	u := os.Getenv(systemOIDCRequestURI)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #106785383085a4ca — Environment-variable access.
pkgs/go/[email protected]/azure_pipelines_credential.go:65 
	sat := os.Getenv(systemAccessToken)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e8f3e26ed064f72 — Environment-variable access.
pkgs/go/[email protected]/confidential_client.go:75 
		region:   os.Getenv(azureRegionalAuthorityName),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7ba73cafa1e6cea — Environment-variable access.
pkgs/go/[email protected]/default_azure_credential.go:69 
		if tenants := os.Getenv(azureAdditionallyAllowedTenants); tenants != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5551c4701d2844d3 — Environment-variable access.
pkgs/go/[email protected]/default_azure_credential.go:100 
	if ID, ok := os.LookupEnv(azureClientID); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab69c40cf279e7a8 — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:87 
	tenantID := os.Getenv(azureTenantID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30edfce02cb98515 — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:91 
	clientID := os.Getenv(azureClientID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3adf61d2b33cc14c — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:98 
		if tenants := os.Getenv(azureAdditionallyAllowedTenants); tenants != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #162af7fcce40b9fc — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:102 
	if clientSecret := os.Getenv(azureClientSecret); clientSecret != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63f157e7fcdfefaf — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:115 
	if certPath := os.Getenv(azureClientCertificatePath); certPath != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9420c1d05b1af615 — Filesystem access.
pkgs/go/[email protected]/environment_credential.go:117 
		certData, err := os.ReadFile(certPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92b2f99846fd75ca — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:122 
		if v := os.Getenv(azureClientCertificatePassword); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3214a9b215a8403 — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:134 
		if v, ok := os.LookupEnv(envVarSendCertChain); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eebae8406b959cf2 — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:143 
	if username := os.Getenv(azureUsername); username != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c38d3960179afa97 — Environment-variable access.
pkgs/go/[email protected]/environment_credential.go:144 
		if password := os.Getenv(azurePassword); password != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0dcfe6f7be719007 — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:76 
		pd := os.Getenv("ProgramData")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #356c87840278141e — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:143 
	if endpoint, ok := os.LookupEnv(identityEndpoint); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5379742bd31ab1c — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:144 
		if _, ok := os.LookupEnv(identityHeader); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #055e54dbf1410b1a — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:145 
			if _, ok := os.LookupEnv(identityServerThumbprint); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a9d3b20b45a9e80 — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:154 
		} else if _, ok := os.LookupEnv(arcIMDSEndpoint); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #065eb10e2cf91922 — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:159 
	} else if endpoint, ok := os.LookupEnv(msiEndpoint); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c54182bc2c4dcc68 — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:161 
		if _, ok := os.LookupEnv(msiSecret); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f1d6ec86c1255ed — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:344 
	request.Raw().Header.Set("X-IDENTITY-HEADER", os.Getenv(identityHeader))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #577e24bdbf96eda3 — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:364 
	request.Raw().Header.Set("secret", os.Getenv(msiSecret))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c56275ae831f448 — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:368 
	q.Add("clientid", os.Getenv(defaultIdentityClientID))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9ee55f97a39c0cc — Environment-variable access.
pkgs/go/[email protected]/managed_identity_client.go:389 
	request.Raw().Header.Set("Secret", os.Getenv(identityHeader))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a1c90f531039f35 — Filesystem access.
pkgs/go/[email protected]/managed_identity_client.go:449 
	key, err := os.ReadFile(p)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b00b95cfabd1d5b — Environment-variable access.
pkgs/go/[email protected]/workload_identity.go:65 
		if clientID, ok = os.LookupEnv(azureClientID); !ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b12cb4d90d9e731 — Environment-variable access.
pkgs/go/[email protected]/workload_identity.go:71 
		if file, ok = os.LookupEnv(azureFederatedTokenFile); !ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7816dbdbbdade51 — Environment-variable access.
pkgs/go/[email protected]/workload_identity.go:77 
		if tenantID, ok = os.LookupEnv(azureTenantID); !ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0140066f9f7ca5d9 — Filesystem access.
pkgs/go/[email protected]/workload_identity.go:117 
			content, err := os.ReadFile(w.file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/Azure/azure-sdk-for-go/sdk/storage/azblob

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #07bf741b9e5dfc8e — Environment-variable access.
pkgs/go/[email protected]/internal/testcommon/common.go:179 
	env, ok := os.LookupEnv(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aliyun/credentials-go

go dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #7e849f619f2f11a2 — Environment-variable access.
pkgs/go/[email protected]/credentials/credential.go:166 
		v = os.Getenv("ALIBABA_CLOUD_CREDENTIALS_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1313e1b6eee39700 — Filesystem access.
pkgs/go/[email protected]/credentials/credential.go:243 
		file, err1 := os.Open(tea.StringValue(config.PrivateKeyFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cec51c98548a38f — Environment-variable access.
pkgs/go/[email protected]/credentials/env_provider.go:27 
	accessKeyId, ok1 := os.LookupEnv(EnvVarAccessKeyIdNew)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d602e058ca2e7dc — Environment-variable access.
pkgs/go/[email protected]/credentials/env_provider.go:29 
		accessKeyId, ok1 = os.LookupEnv(EnvVarAccessKeyId)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ed04af7ca65c314 — Environment-variable access.
pkgs/go/[email protected]/credentials/env_provider.go:31 
	accessKeySecret, ok2 := os.LookupEnv(EnvVarAccessKeySecret)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a3c146b5e758925 — Environment-variable access.
pkgs/go/[email protected]/credentials/instance_provider.go:18 
	roleName, ok := os.LookupEnv(ENVEcsMetadata)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a678fb2d7695784 — Environment-variable access.
pkgs/go/[email protected]/credentials/oidc_credential.go:108 
		tokenPath = os.Getenv("ALIBABA_CLOUD_OIDC_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c42a1ec5f93e81d0 — Filesystem access.
pkgs/go/[email protected]/credentials/oidc_credential.go:113 
	byt, err := ioutil.ReadFile(tokenPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed0ff8d921f067ae — Environment-variable access.
pkgs/go/[email protected]/credentials/oidc_credential_provider.go:18 
	roleArn, ok1 := os.LookupEnv(ENVRoleArn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d3a4355bb803c37 — Environment-variable access.
pkgs/go/[email protected]/credentials/oidc_credential_provider.go:19 
	oidcProviderArn, ok2 := os.LookupEnv(ENVOIDCProviderArn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3784916c9401250f — Environment-variable access.
pkgs/go/[email protected]/credentials/oidc_credential_provider.go:20 
	oidcTokenFilePath, ok3 := os.LookupEnv(ENVOIDCTokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9068728f7f5026a4 — Environment-variable access.
pkgs/go/[email protected]/credentials/oidc_credential_provider.go:32 
	roleSessionName, ok := os.LookupEnv(ENVRoleSessionName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #700680d7d824a341 — Environment-variable access.
pkgs/go/[email protected]/credentials/profile_provider.go:47 
	path, ok := os.LookupEnv(ENVCredentialFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69e042930d23e0bb — Environment-variable access.
pkgs/go/[email protected]/credentials/profile_provider.go:299 
		path, ok := os.LookupEnv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #818a7b3c2756d944 — Environment-variable access.
pkgs/go/[email protected]/credentials/profile_provider.go:305 
	path, ok := os.LookupEnv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #967c3cf879807135 — Environment-variable access.
pkgs/go/[email protected]/credentials/uri_credential.go:32 
		URL = os.Getenv("ALIBABA_CLOUD_CREDENTIALS_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/antlr4-go/antlr/v4

go dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #03e3efedb30e3f99 — Filesystem access.
pkgs/go/[email protected]/file_stream.go:23 
	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4205b2b250a6683e — Filesystem access.
pkgs/go/[email protected]/statistics.go:158 
	f, err := os.OpenFile(cname, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da06eb0a08d1d064 — Filesystem access.
pkgs/go/[email protected]/statistics.go:175 
	f, err = os.OpenFile(fname, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/apache/arrow/go/v17

go dependency
expand_more 26 low-confidence finding(s)
low env_fs dependency Excluded from app score #46857d5245cc144d — Filesystem access.
pkgs/go/[email protected]/arrow/_tools/tmpl/main.go:124 
	data, err := ioutil.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3bdce41de90bb50 — Filesystem access.
pkgs/go/[email protected]/arrow/_tools/tmpl/main.go:184 
		os.WriteFile(spec.out, generated, fileMode(spec.in))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1339e2d3338e7db1 — Filesystem access.
pkgs/go/[email protected]/arrow/avro/avro2parquet/main.go:43 
		f, err := os.Create(*cpuprofile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e0196df64203522 — Filesystem access.
pkgs/go/[email protected]/arrow/avro/avro2parquet/main.go:65 
	data, err := os.ReadFile(*filepath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #396fbaa69cf565c7 — Filesystem access.
pkgs/go/[email protected]/arrow/avro/avro2parquet/main.go:79 
	fp, err := os.OpenFile(*filepath+".parquet", os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11db12ba62ba497e — Filesystem access.
pkgs/go/[email protected]/arrow/gen-flatbuffers.go:78 
	raw, err := ioutil.ReadFile(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ea46be33bae0131 — Filesystem access.
pkgs/go/[email protected]/arrow/gen-flatbuffers.go:83 
	f, err := os.Create(dst)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #110a59f5bbb569d7 — Filesystem access.
pkgs/go/[email protected]/arrow/internal/cdata_integration/entrypoints.go:70 
	f, err := os.Open(jsonPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42fa19f3592ab4a4 — Filesystem access.
pkgs/go/[email protected]/arrow/internal/flight_integration/scenario.go:173 
	r, err := os.Open(s.path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5191af0d5ab236d2 — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-cat/main.go:125 
	f, err := os.Open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bbe15cf993aeb3f — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-file-to-stream/main.go:50 
	r, err := os.Open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6381acae70e8fcee — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-json-integration-test/main.go:76 
	r, err := os.Open(arrowName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd4b1972835b446c — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-json-integration-test/main.go:82 
	w, err := os.Create(jsonName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd774a732f619c54 — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-json-integration-test/main.go:127 
	r, err := os.Open(jsonName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f8dd0a737007949 — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-json-integration-test/main.go:133 
	w, err := os.Create(arrowName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d34db149ded160cb — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-json-integration-test/main.go:177 
	jr, err := os.Open(jsonName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a62cf6d5d41dbf3c — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-json-integration-test/main.go:188 
	ar, err := os.Open(arrowName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8e1a716592f4953 — Filesystem access.
pkgs/go/[email protected]/arrow/ipc/cmd/arrow-ls/main.go:122 
	f, err := os.Open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a2191160ec07bf8 — Environment-variable access.
pkgs/go/[email protected]/arrow/memory/checked_allocator.go:123 
	if val, ok := os.LookupEnv("ARROW_CHECKED_ALLOC_FRAMES"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1148ed5d95bcad6 — Environment-variable access.
pkgs/go/[email protected]/arrow/memory/checked_allocator.go:129 
	if val, ok := os.LookupEnv("ARROW_CHECKED_REALLOC_FRAMES"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80a3dea087877feb — Environment-variable access.
pkgs/go/[email protected]/arrow/memory/checked_allocator.go:135 
	if val, ok := os.LookupEnv("ARROW_CHECKED_MAX_RETAINED_FRAMES"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4151334fd889e1f — Environment-variable access.
pkgs/go/[email protected]/internal/utils/min_max_arm64.go:31 
	if ext, ok := os.LookupEnv("ARM_ENABLE_EXT"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e875b28112c7abd5 — Filesystem access.
pkgs/go/[email protected]/parquet/cmd/parquet_reader/main.go:77 
		fileOut, err := os.Create(config.Output)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f271393859aae4c6 — Filesystem access.
pkgs/go/[email protected]/parquet/file/file_reader.go:89 
		source, err = os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4a28b67b677eef3 — Environment-variable access.
pkgs/go/[email protected]/parquet/internal/bmi/bmi_arm64.go:33 
	if ext, ok := os.LookupEnv("ARM_ENABLE_EXT"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0638021eb06abc66 — Environment-variable access.
pkgs/go/[email protected]/parquet/internal/utils/unpack_bool_arm64.go:34 
	if ext, ok := os.LookupEnv("ARM_ENABLE_EXT"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/apache/pulsar-client-go

go dependency
expand_more 30 low-confidence finding(s)
low env_fs dependency Excluded from app score #0d32b9455da28a3a — Filesystem access.
pkgs/go/[email protected]/oauth2/client_credentials_provider.go:58 
		keyFile, err = os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ce1fd4983877812 — Filesystem access.
pkgs/go/[email protected]/oauth2/client_credentials_provider.go:68 
		keyFile, err = os.ReadFile(k.KeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e1e1dbc0e65331c — Filesystem access.
pkgs/go/[email protected]/perf/pulsar-perf-go.go:61 
		tokenBytes, err := os.ReadFile(clientArgs.TokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e936f5bdddb1b75 — Filesystem access.
pkgs/go/[email protected]/pulsar/auth/athenz.go:247 
		pem, err := os.ReadFile(uriSt.Path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b431eac160e387bf — Filesystem access.
pkgs/go/[email protected]/pulsar/auth/token.go:71 
			data, err := os.ReadFile(tokenFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f0bf016cf85347f — Filesystem access.
pkgs/go/[email protected]/pulsar/crypto/default_crypto_Key_reader.go:46 
	key, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6c0d4ffba594c92 — Filesystem access.
pkgs/go/[email protected]/pulsar/internal/connection.go:1124 
		caCerts, err := os.ReadFile(c.tlsOptions.TrustCertsFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efcb03e8b6b4a53b — Filesystem access.
pkgs/go/[email protected]/pulsar/internal/http_client.go:353 
				rootCA, err := os.ReadFile(tlsConfig.TrustCertsFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37bc73431c39a825 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/auth/token.go:57 
	data, err := os.ReadFile(tokenFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e2aa89b9b5461b3 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/auth/transport.go:50 
		rootCA, err := os.ReadFile(config.TLSTrustCertsFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c4b4a7e12ff3512 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:322 
		file, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #623a8c1bfc84ecf7 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:450 
	_, err := os.Open(destinationFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #346778ae42f34ead — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:457 
	file, err := os.Create(destinationFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6668f465a0df7ce — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:484 
	_, err := os.Open(destinationFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4db19fd3e9245372 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:491 
	file, err := os.Create(destinationFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #066bf47a40b2e3fc — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:634 
		file, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #367e7f6a908b7e89 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:892 
		file, err := os.Open(triggerFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9270812ef03c2edc — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/functions.go:959 
	file, err := os.Open(sourceFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03cda26f86e39393 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/packages.go:168 
	_, err = os.Open(destinationFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54177942f8c4e4b7 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/packages.go:175 
	file, err := os.Create(destinationFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69e1c51b6b8ef1d7 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/packages.go:236 
	file, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcb76b61c566e0c5 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/sinks.go:236 
		file, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c5936db7046335e — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/sinks.go:369 
		file, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33f8ddff37ebb468 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/sources.go:240 
		file, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #acf27d17bcbbf971 — Filesystem access.
pkgs/go/[email protected]/pulsaradmin/pkg/admin/sources.go:373 
		file, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f833e3352e0c45e — Environment-variable access.
pkgs/go/[email protected]/pulsaradmin/pkg/utils/home_dir.go:38 
		home := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fdf8f18388cd727 — Environment-variable access.
pkgs/go/[email protected]/pulsaradmin/pkg/utils/home_dir.go:40 
		if homeDrive, homePath := os.Getenv("HOMEDRIVE"), os.Getenv("HOMEPATH"); len(homeDrive) > 0 && len(homePath) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d93d2b0f8e87ae8 — Environment-variable access.
pkgs/go/[email protected]/pulsaradmin/pkg/utils/home_dir.go:43 
		userProfile := os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #627a9d5eb1d2e1f9 — Environment-variable access.
pkgs/go/[email protected]/pulsaradmin/pkg/utils/home_dir.go:96 
	return os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d42c15b4c474ba2 — Environment-variable access.
pkgs/go/[email protected]/pulsaradmin/pkg/utils/utils.go:44 
	if envConf, ok := os.LookupEnv("PULSAR_CLIENT_CONF_PATH"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2

go dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #bf220fa659632353 — Filesystem access.
pkgs/go/[email protected]/aws/generate.go:29 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94bb2c9df881e624 — Filesystem access.
pkgs/go/[email protected]/aws/logging_generate.go:85 
	file, err := os.Create("logging.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d52384dc691f539e — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/recursion_detection.go:40 
	_, hasLambdaEnv := os.LookupEnv(envAwsLambdaFunctionName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #acc1b9c4d3930868 — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/recursion_detection.go:41 
	xAmznTraceID, hasTraceID := os.LookupEnv(envAmznTraceID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d824a8bb8977a7d — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/user_agent.go:201 
	if ev := os.Getenv(execEnvVar); len(ev) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf425cf3b33fa8ce — Environment-variable access.
pkgs/go/[email protected]/internal/awstesting/util.go:106 
	originalEnv := os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffc0205ec01d5624 — Environment-variable access.
pkgs/go/[email protected]/internal/awstesting/util.go:150 
		if val, ok := os.LookupEnv(env); ok && len(val) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #679fb1d154d41199 — Filesystem access.
pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:90 
	modelFile, err := os.Open(modelFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #206b43fbfaaae41d — Filesystem access.
pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:101 
	file, err := os.Create(outputFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/config

go dependency
expand_more 35 low-confidence finding(s)
low env_fs dependency Excluded from app score #97f0f44c16477fa5 — Filesystem access.
pkgs/go/[email protected]/codegen/main.go:94 
	file, err := os.OpenFile(config.OutputPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0744)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a571e06cbaf9865d — Environment-variable access.
pkgs/go/[email protected]/config.go:221 
	if os.Getenv(awsProfileEnv) != "" || options.SharedConfigProfile != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f38d237b827c01e — Environment-variable access.
pkgs/go/[email protected]/defaultsmode.go:43 
		EnvironmentIdentifier:     aws.ExecutionEnvironmentID(os.Getenv(execEnvVar)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfbc7f7f24c79aae — Environment-variable access.
pkgs/go/[email protected]/env_config.go:326 
		creds.AccountID = os.Getenv(awsAccountIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bafe28d91f19049a — Environment-variable access.
pkgs/go/[email protected]/env_config.go:327 
		creds.SessionToken = os.Getenv(awsSessionTokenEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f69d1b57e54526e — Environment-variable access.
pkgs/go/[email protected]/env_config.go:331 
	cfg.ContainerCredentialsEndpoint = os.Getenv(awsContainerCredentialsFullURIEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a6d0d65f49922bb — Environment-variable access.
pkgs/go/[email protected]/env_config.go:332 
	cfg.ContainerCredentialsRelativePath = os.Getenv(awsContainerCredentialsRelativeURIEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b65118ea59412af8 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:333 
	cfg.ContainerAuthorizationToken = os.Getenv(awsContainerAuthorizationTokenEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b34c3f0c97bc9e6 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:338 
	cfg.SharedCredentialsFile = os.Getenv(awsSharedCredentialsFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13790b3c2e681619 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:339 
	cfg.SharedConfigFile = os.Getenv(awsConfigFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95f0fbfbc2da0f46 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:341 
	cfg.CustomCABundle = os.Getenv(awsCABundleEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e361caa09acbbae5 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:343 
	cfg.WebIdentityTokenFilePath = os.Getenv(awsWebIdentityTokenFileEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bacf000b86a6021a — Environment-variable access.
pkgs/go/[email protected]/env_config.go:345 
	cfg.RoleARN = os.Getenv(awsRoleARNEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a1163fc6e16e29d — Environment-variable access.
pkgs/go/[email protected]/env_config.go:346 
	cfg.RoleSessionName = os.Getenv(awsRoleSessionNameEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9855a0619b069695 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:348 
	cfg.AppID = os.Getenv(awsSdkUaAppIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a4c64266d80a6d5 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:369 
	cfg.EC2IMDSEndpoint = os.Getenv(awsEc2MetadataServiceEndpointEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a457f22c50eafc6f — Environment-variable access.
pkgs/go/[email protected]/env_config.go:478 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bc920653f018551 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:496 
		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f51ffd267e533ac — Environment-variable access.
pkgs/go/[email protected]/env_config.go:508 
		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b8fba796b67df71 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:521 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4f7afc7ab527e29 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:534 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #395bf66b9a43fb2b — Environment-variable access.
pkgs/go/[email protected]/env_config.go:556 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96f9c839962be852 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:575 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dfe5d5bea037ce9 — Filesystem access.
pkgs/go/[email protected]/env_config.go:649 
	b, err := os.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f0a056d19932760 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:673 
	if endpt := os.Getenv(fmt.Sprintf("%s_%s", awsEndpointURLEnv, normalizeEnv(sdkID))); endpt != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ff961acce567172 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:726 
		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ecac18ef333d36e — Environment-variable access.
pkgs/go/[email protected]/env_config.go:735 
		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20c311eb29b916ac — Environment-variable access.
pkgs/go/[email protected]/env_config.go:750 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f17c552d54e85a52 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:777 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cea4cf8dd398bf47 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:801 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba37f28a88ba70f9 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:824 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abd42ef7abb11bd3 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:845 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc960273d12ab5c9 — Environment-variable access.
pkgs/go/[email protected]/resolve_credentials.go:340 
			if authFilePath := os.Getenv(httpProviderAuthFileEnvVar); authFilePath != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d5315d2b20cab4d — Filesystem access.
pkgs/go/[email protected]/resolve_credentials.go:344 
					if contents, err = ioutil.ReadFile(authFilePath); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb4b3120952d2575 — Filesystem access.
pkgs/go/[email protected]/shared_config.go:495 
	b, err := ioutil.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/credentials

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #1f783fb76d47417c — Environment-variable access.
pkgs/go/[email protected]/processcreds/provider.go:107 
	cmd.Env = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0684851696bbefda — Filesystem access.
pkgs/go/[email protected]/ssocreds/sso_cached_token.go:148 
	fileBytes, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6bebcc9c643978f9 — Filesystem access.
pkgs/go/[email protected]/ssocreds/sso_cached_token.go:181 
	f, err = os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_RDWR, fileMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a607bd8c66603443 — Filesystem access.
pkgs/go/[email protected]/stscreds/web_identity_provider.go:83 
	b, err := ioutil.ReadFile(string(j))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/service/bedrockruntime

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #cf4accfe99dfb2b0 — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:207 
	_, g := os.LookupEnv("AWS_ENDPOINT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f50c0b12870a37c5 — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:208 
	_, s := os.LookupEnv("AWS_ENDPOINT_URL_BEDROCK_RUNTIME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/bytedance/mockey

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #6148457f5a8cb2e0 — Environment-variable access.
pkgs/go/[email protected]/internal/tool/check_gcflags.go:29 
	if flag := os.Getenv("MOCKEY_CHECK_GCFLAGS"); flag != "false" && !IsGCFlagsSet() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fec1d4fb11ac442 — Environment-variable access.
pkgs/go/[email protected]/internal/tool/debug.go:27 
	if flag := os.Getenv("MOCKEY_DEBUG"); flag == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/bytedance/sonic

go dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #e6c4bd2e04af88a2 — Environment-variable access.
pkgs/go/[email protected]/internal/cpu/features.go:32 
	switch v := os.Getenv("SONIC_MODE"); v {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef4e6e65479dd27d — Environment-variable access.
pkgs/go/[email protected]/internal/decoder/jitdec/debug.go:29 
	debugSyncGC  = os.Getenv("SONIC_SYNC_GC") != ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d449c687d55e359 — Environment-variable access.
pkgs/go/[email protected]/internal/decoder/jitdec/debug.go:30 
	debugAsyncGC = os.Getenv("SONIC_NO_ASYNC_GC") == ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fca12e10463ebec1 — Environment-variable access.
pkgs/go/[email protected]/internal/encoder/vars/const.go:37 
	DebugSyncGC   = os.Getenv("SONIC_SYNC_GC") != ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bbd2584a9ec2dc1 — Environment-variable access.
pkgs/go/[email protected]/internal/encoder/vars/const.go:38 
	DebugAsyncGC  = os.Getenv("SONIC_NO_ASYNC_GC") == ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1f8d32a53b877ad — Environment-variable access.
pkgs/go/[email protected]/internal/encoder/vars/const.go:39 
	DebugCheckPtr = os.Getenv("SONIC_CHECK_POINTER") != ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27f568b88a629c76 — Environment-variable access.
pkgs/go/[email protected]/internal/encoder/vars/const.go:42 
var UseVM = os.Getenv("SONIC_ENCODER_USE_VM") != ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #505a9a7e14017785 — Environment-variable access.
pkgs/go/[email protected]/internal/encoder/vars/errors.go:86 
	if v := os.Getenv("SONIC_PANIC_MAX_JSON_LENGTH"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #518e092d0424637d — Environment-variable access.
pkgs/go/[email protected]/internal/encoder/x86/debug_go116.go:32 
	debugSyncGC  = os.Getenv("SONIC_SYNC_GC") != ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b0393204186649b — Environment-variable access.
pkgs/go/[email protected]/internal/encoder/x86/debug_go116.go:33 
	debugAsyncGC = os.Getenv("SONIC_NO_ASYNC_GC") == ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d73f4e7307abeba2 — Environment-variable access.
pkgs/go/[email protected]/internal/envs/decode.go:7 
var UseOptDec = os.Getenv("SONIC_USE_OPTDEC") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3361e7c93ac8516f — Environment-variable access.
pkgs/go/[email protected]/internal/envs/decode.go:8 
var UseFastMap = os.Getenv("SONIC_USE_FASTMAP") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/casbin/casbin/v2

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #4d978bce96c06f04 — Filesystem access.
pkgs/go/[email protected]/config/config.go:91 
	f, err := os.Open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2e0fd8064bb2010 — Filesystem access.
pkgs/go/[email protected]/persist/file-adapter/adapter.go:89 
	f, err := os.Open(a.filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72ece2235c1a0ff0 — Filesystem access.
pkgs/go/[email protected]/persist/file-adapter/adapter.go:107 
	f, err := os.Create(a.filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #103d97e4e308612e — Filesystem access.
pkgs/go/[email protected]/persist/file-adapter/adapter_filtered.go:81 
	f, err := os.Open(a.filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad4a0360a8408720 — Filesystem access.
pkgs/go/[email protected]/persist/file-adapter/adapter_mock.go:54 
	f, err := os.Open(a.filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/confluentinc/confluent-kafka-go

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #6d8ef2fb04f44d45 — Filesystem access.
pkgs/go/[email protected]/kafka/go_rdkafka_generr/go_rdkafka_generr.go:30 
	f, err := os.Create(outfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2af3b36f4c726030 — Filesystem access.
pkgs/go/[email protected]/kafka/testhelpers.go:49 
	cf, err := os.Open("testconf.json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0938ed50cd5851ad — Environment-variable access.
pkgs/go/[email protected]/kafka/testhelpers.go:70 
		testconf.Brokers = os.Getenv(testconf.Brokers[1:])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8587bade127846f2 — Filesystem access.
pkgs/go/[email protected]/schemaregistry/rest_service.go:171 
		caCert, err := ioutil.ReadFile(caFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b9b2410cf33a129 — Filesystem access.
pkgs/go/[email protected]/schemaregistry/testhelpers.go:40 
	cf, err := os.Open("../kafka/testconf.json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/containerd/cgroups/v3

go dependency
expand_more 48 low-confidence finding(s)
low env_fs dependency Excluded from app score #8cac81c3587e6f2a — Filesystem access.
pkgs/go/[email protected]/cgroup1/blkio.go:75 
			if err := os.WriteFile(
				filepath.Join(b.Path(path), "blkio."+t.name),
				t.format(t.value),
				defaultFilePerm,
			); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3ffd75d1977159d — Filesystem access.
pkgs/go/[email protected]/cgroup1/blkio.go:134 
	f, err := os.Open(filepath.Join(b.procRoot, "partitions"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #726829505c3e5942 — Filesystem access.
pkgs/go/[email protected]/cgroup1/blkio.go:177 
	f, err := os.Open(filepath.Join(b.Path(path), "blkio."+name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #619da91af6cc2e60 — Filesystem access.
pkgs/go/[email protected]/cgroup1/cgroup.go:201 
	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, perm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15155679c7eeff29 — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpu.go:85 
				if err := os.WriteFile(
					filepath.Join(c.Path(path), "cpu."+t.name),
					value,
					defaultFilePerm,
				); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #036ba27a9fc581f2 — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpu.go:103 
	f, err := os.Open(filepath.Join(c.Path(path), "cpu.stat"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad3b77ee41daa173 — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpuacct.go:74 
	data, err := os.ReadFile(filepath.Join(c.Path(path), "cpuacct.usage_percpu"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ac60508594ecd94 — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpuacct.go:90 
	f, err := os.Open(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f0f8d83cb390fe2 — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpuset.go:71 
				if err := os.WriteFile(
					filepath.Join(c.Path(path), "cpuset."+t.name),
					[]byte(t.value),
					defaultFilePerm,
				); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec4cb3c511e450cf — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpuset.go:89 
	if cpus, err = os.ReadFile(filepath.Join(path, "cpuset.cpus")); err != nil && !os.IsNotExist(err) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b7d3b253acb8c3e — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpuset.go:92 
	if mems, err = os.ReadFile(filepath.Join(path, "cpuset.mems")); err != nil && !os.IsNotExist(err) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f445c9d21ac8e68b — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpuset.go:136 
		if err := os.WriteFile(
			filepath.Join(current, "cpuset.cpus"),
			parentCpus,
			defaultFilePerm,
		); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a773927c5fae245 — Filesystem access.
pkgs/go/[email protected]/cgroup1/cpuset.go:145 
		if err := os.WriteFile(
			filepath.Join(current, "cpuset.mems"),
			parentMems,
			defaultFilePerm,
		); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03c1f1098ffe4a73 — Filesystem access.
pkgs/go/[email protected]/cgroup1/devices.go:63 
		if err := os.WriteFile(
			filepath.Join(d.Path(path), file),
			[]byte(deviceString(device)),
			defaultFilePerm,
		); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a468b4393a6800b — Filesystem access.
pkgs/go/[email protected]/cgroup1/freezer.go:53 
	return os.WriteFile(
		filepath.Join(f.root, path, "freezer.state"),
		[]byte(strings.ToUpper(string(state))),
		defaultFilePerm,
	)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2e6a292ce203f2c — Filesystem access.
pkgs/go/[email protected]/cgroup1/freezer.go:61 
	current, err := os.ReadFile(filepath.Join(f.root, path, "freezer.state"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d677a1ef4589fe12 — Filesystem access.
pkgs/go/[email protected]/cgroup1/hugetlb.go:59 
		if err := os.WriteFile(
			filepath.Join(h.Path(path), strings.Join([]string{"hugetlb", limit.Pagesize, "limit_in_bytes"}, ".")),
			[]byte(strconv.FormatUint(limit.Limit, 10)),
			defaultFilePerm,
		); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d3927fd73e52e3a — Filesystem access.
pkgs/go/[email protected]/cgroup1/memory.go:235 
	fMemStat, err := os.Open(filepath.Join(m.Path(path), "memory.stat"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cacf29c8a3ee15af — Filesystem access.
pkgs/go/[email protected]/cgroup1/memory.go:250 
	fMemOomControl, err := os.Open(filepath.Join(m.Path(path), "memory.oom_control"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa487ececbdb4ffe — Filesystem access.
pkgs/go/[email protected]/cgroup1/memory.go:397 
			if err := os.WriteFile(
				filepath.Join(m.Path(path), "memory."+t.name),
				[]byte(strconv.FormatInt(*t.value, 10)),
				defaultFilePerm,
			); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c49d7dae773d19d6 — Filesystem access.
pkgs/go/[email protected]/cgroup1/memory.go:470 
	evtFile, err := os.Open(filepath.Join(root, event.EventFile()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2902e892f250dd19 — Filesystem access.
pkgs/go/[email protected]/cgroup1/memory.go:478 
	if err := os.WriteFile(evctlPath, []byte(data), 0o700); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f396299c7b0136b1 — Filesystem access.
pkgs/go/[email protected]/cgroup1/net_cls.go:50 
		return os.WriteFile(
			filepath.Join(n.Path(path), "net_cls.classid"),
			[]byte(strconv.FormatUint(uint64(*resources.Network.ClassID), 10)),
			defaultFilePerm,
		)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #150baec6b030ef58 — Filesystem access.
pkgs/go/[email protected]/cgroup1/net_prio.go:51 
			if err := os.WriteFile(
				filepath.Join(n.Path(path), "net_prio.ifpriomap"),
				formatPrio(prio.Name, prio.Priority),
				defaultFilePerm,
			); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63fb4541e7b3b407 — Filesystem access.
pkgs/go/[email protected]/cgroup1/pids.go:51 
		return os.WriteFile(
			filepath.Join(p.Path(path), "pids.max"),
			[]byte(strconv.FormatInt(resources.Pids.Limit, 10)),
			defaultFilePerm,
		)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e726ca80397592cc — Filesystem access.
pkgs/go/[email protected]/cgroup1/rdma.go:70 
			return os.WriteFile(
				filepath.Join(p.Path(path), "rdma.max"),
				[]byte(createCmdString(device, &limit)),
				defaultFilePerm,
			)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #877a33cb765b66a6 — Filesystem access.
pkgs/go/[email protected]/cgroup1/rdma.go:127 
	currentData, err := os.ReadFile(filepath.Join(p.Path(path), "rdma.current"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9069d600755d2a6d — Filesystem access.
pkgs/go/[email protected]/cgroup1/rdma.go:133 
	maxData, err := os.ReadFile(filepath.Join(p.Path(path), "rdma.max"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06dbfa77b1949117 — Filesystem access.
pkgs/go/[email protected]/cgroup1/utils.go:85 
	f, err := os.Open(filepath.Join(path, pType))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d977f244c1b4dba — Filesystem access.
pkgs/go/[email protected]/cgroup1/utils.go:135 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #236a8faad1d707a9 — Filesystem access.
pkgs/go/[email protected]/cgroup1/utils.go:212 
	f, err := os.Open("/proc/self/mountinfo")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b2624d4da3f25ef — Filesystem access.
pkgs/go/[email protected]/cgroup1/v1.go:50 
	f, err := os.Open("/proc/self/mountinfo")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c8f8f545e49e653 — Filesystem access.
pkgs/go/[email protected]/cgroup2/manager.go:148 
	return os.WriteFile(
		filepath.Join(path, c.filename),
		data,
		perm,
	)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3313e94c0e7e3e2 — Filesystem access.
pkgs/go/[email protected]/cgroup2/manager.go:250 
	val, err := os.ReadFile(filepath.Join(c.path, typeFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99a477d8417a3187 — Filesystem access.
pkgs/go/[email protected]/cgroup2/manager.go:271 
	b, err := os.ReadFile(filepath.Join(c.unifiedMountpoint, controllersFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96f1186bed77cb7a — Filesystem access.
pkgs/go/[email protected]/cgroup2/manager.go:279 
	b, err := os.ReadFile(filepath.Join(c.path, controllersFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bea4f72ad8b89b3 — Filesystem access.
pkgs/go/[email protected]/cgroup2/manager.go:332 
	f, err := os.OpenFile(filePath, os.O_WRONLY, 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1541bd5689e2ee2 — Filesystem access.
pkgs/go/[email protected]/cgroup2/manager.go:636 
	f, err := os.Open(filepath.Join(path, file))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91949e5cf9627275 — Filesystem access.
pkgs/go/[email protected]/cgroup2/state.go:53 
	current, err := os.ReadFile(filepath.Join(path, cgroupFreeze))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05c26db4397082d2 — Filesystem access.
pkgs/go/[email protected]/cgroup2/utils.go:74 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ca43dcf66c6a331 — Filesystem access.
pkgs/go/[email protected]/cgroup2/utils.go:127 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95cd034a056692d2 — Filesystem access.
pkgs/go/[email protected]/cgroup2/utils.go:246 
	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #886986c98a9c03c8 — Filesystem access.
pkgs/go/[email protected]/cgroup2/utils.go:278 
	currentData, err := os.ReadFile(fpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fc5b8ad3a4e15ef — Filesystem access.
pkgs/go/[email protected]/cgroup2/utils.go:332 
	currentData, err := os.ReadFile(filepath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d87b3a92ee54006a — Filesystem access.
pkgs/go/[email protected]/cgroup2/utils.go:423 
		dir, err := os.OpenFile("/sys/kernel/mm/hugepages", unix.O_DIRECTORY|unix.O_RDONLY, 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b01ee79c8603ffa — Filesystem access.
pkgs/go/[email protected]/cgroup2/utils.go:488 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7945a982b048ef01 — Filesystem access.
pkgs/go/[email protected]/utils.go:82 
		file, err := os.Open("/proc/self/uid_map")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48ae44bfed104dd6 — Filesystem access.
pkgs/go/[email protected]/utils.go:114 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/dave/jennifer

go dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #2d60ab1d21355643 — Filesystem access.
pkgs/go/[email protected]/genjen/main.go:14 
	if err := os.WriteFile("./jen/generated.go", buf.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #632f98c89c0f0cf8 — Filesystem access.
pkgs/go/[email protected]/gennames/main.go:26 
	if err := os.WriteFile(*out, buf.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54651036afadc2b0 — Filesystem access.
pkgs/go/[email protected]/jen/jen.go:27 
	if err := os.WriteFile(filename, buf.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/gin-gonic/gin

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #a40e814338cce6ae — Filesystem access.
pkgs/go/[email protected]/context.go:718 
	out, err := os.Create(dst)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8dbb083c1da7f31 — Environment-variable access.
pkgs/go/[email protected]/logger.go:227 
	if w, ok := out.(*os.File); !ok || os.Getenv("TERM") == "dumb" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1def4207cbd90858 — Environment-variable access.
pkgs/go/[email protected]/mode.go:53 
	mode := os.Getenv(EnvGinMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9e412fed1a1bdd4 — Filesystem access.
pkgs/go/[email protected]/recovery.go:130 
			data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9785275fc5c77492 — Environment-variable access.
pkgs/go/[email protected]/utils.go:143 
		if port := os.Getenv("PORT"); port != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/go-playground/validator/v10

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #b45d7c330c793b1f — Filesystem access.
pkgs/go/[email protected]/baked_in.go:1592 
		file, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/gofrs/flock

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #c62991a07b3a978f — Filesystem access.
pkgs/go/[email protected]/flock.go:128 
	fh, err := os.OpenFile(f.path, flags, os.FileMode(0600))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee886f6966c29feb — Filesystem access.
pkgs/go/[email protected]/flock_unix.go:187 
			fh, err := os.OpenFile(f.path, os.O_CREATE|os.O_RDWR, os.FileMode(0600))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/hamba/avro/v2

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #d78d169d3f5e45b4 — Filesystem access.
pkgs/go/[email protected]/cmd/avrogen/main.go:142 
		file, err := os.Create(filepath.Clean(filename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba4096d96c6a04f9 — Filesystem access.
pkgs/go/[email protected]/cmd/avrogen/main.go:224 
	return os.ReadFile(filepath.Clean(templateFileName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4522c95326b757b — Filesystem access.
pkgs/go/[email protected]/protocol.go:206 
	s, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a38d81f6227a6dd3 — Filesystem access.
pkgs/go/[email protected]/schema_parse.go:51 
		s, err := os.ReadFile(filepath.Clean(path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/magiconair/properties

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #c752af33f43e5bb4 — Filesystem access.
pkgs/go/[email protected]/load.go:94 
	data, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af352895eca380d2 — Environment-variable access.
pkgs/go/[email protected]/properties.go:776 
			val = os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/minio/minio-go/v7

go dependency
expand_more 376 low-confidence finding(s)
low env_fs dependency Excluded from app score #913a62ff598e4836 — Filesystem access.
pkgs/go/[email protected]/api-get-object-file.go:75 
	filePart, err := os.OpenFile(filePartPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cc51189814c3980 — Filesystem access.
pkgs/go/[email protected]/api-put-object-file-context.go:40 
	fileReader, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5309924042556995 — Filesystem access.
pkgs/go/[email protected]/api-putobject-snowball.go:138 
			f, err := os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88cca0c13541f475 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:80 
	transport, err = minio.DefaultTransport(mustParseBool(os.Getenv(enableHTTPS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ef1d38d3d931d41 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:86 
	if mustParseBool(os.Getenv(skipCERTValidation)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bd92631b1f4912a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:266 
	return os.Getenv("RUN_ON_FAIL") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a1a50fea5945730 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:272 
	if os.Getenv(serverEndpoint) == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c760d0163b67ed8 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:280 
var mintDataDir = os.Getenv("MINT_DATA_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5160905617ac7c32 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:338 
	reader, _ := os.Open(getMintDataDirFilePath(fileName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #770ff2d864a86dc3 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:342 
		reader, _ = os.Open(getMintDataDirFilePath(fileName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2074f648e97a4c7c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:384 
	return os.Getenv("MINT_MODE") == "full"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f644e6d91bec4e6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:414 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8371bb0bcf4445b1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:416 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #373775437d9705de — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:417 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #512301437b6b341a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:468 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #274c42d78e01e85f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:470 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae7ed2a82d97c508 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:471 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cefa81e9050ad146 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:538 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57d461e9a9c49fab — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:540 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c66af570c35084ba — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:542 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebabdac575f5ecf1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:605 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5dc8a53c26bde51 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:607 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5508bab315d28a57 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:609 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #364216424adac1b1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:704 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01c309f263bcb121 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:706 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d82d2f26c607a55e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:708 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebfd449e235f70b5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:824 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77297f37fc7f7618 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:826 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62d49f5d20754b48 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:828 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3ed4fc2356aabf7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:942 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07465323aee2bcf8 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:944 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2b6329ea1563cfd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:946 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ad093ad1270f54c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1082 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #018cc0aed5d104ce — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1084 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #623c9b5275a58b43 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1086 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #715182540079e714 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1228 
		Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d964cd2793dc297 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1230 
		Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb4d7cc98f87dd31 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1232 
	c, err := minio.New(os.Getenv(serverEndpoint), opts)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a9f7918cfefddd9 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1237 
	core, err := minio.NewCore(os.Getenv(serverEndpoint), opts)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #329cfd650804fd83 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1354 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80e7716f553963b5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1356 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77854a18c5c85ec3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1358 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05a5756c0d75b6fa — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1492 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b23758263217b59 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1494 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0666b1f2829fe275 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1496 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36a2aa83aa1e4ea8 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1653 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b27450b36c3a5b3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1655 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #deecd78cc8fe3259 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1657 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45cfd4bda93738fb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1794 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef80b3ceda36764f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1796 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #321f249bd3d8b3ca — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1798 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32d10d132cdccb31 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1907 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed65491da6e9ea99 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1909 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cfbee25c26321b9 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:1911 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a43fae51892a655 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2003 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4a0e0e7e9c5414f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2005 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da8ec4df816942b7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2007 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fef0f4977ebe58c7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2171 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #275bc83e0b1a9ac6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2173 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #950cd1883b7b1ed8 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2175 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f059121248ffa91 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2366 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b89dccaceaf415e1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2368 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #439012d27a2a046f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2370 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51128174f1c784ec — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2536 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #509433f1f3183155 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2538 
			Creds:           credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #709a6037cd01593e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2540 
			Secure:          mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f9319a8b3f86198 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2750 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #969ac39be479e7ee — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2752 
			Creds:           credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d979246aa2e34d46 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2754 
			Secure:          mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5dbacb3790c539a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2856 
		if mustParseBool(os.Getenv(enableHTTPS)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66312d16f1ac2098 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2902 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #893b596ea6182002 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2905 
			Creds:           credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0d0b20d0f7a9975 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:2907 
			Secure:          mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #056acbfe8d1f54f0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3109 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24dd3acca2043e84 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3112 
			Creds:           credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be0a937afc6b9015 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3113 
			Secure:          mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48e6efa425dec5c1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3194 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f6d18d802a93805 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3197 
			Creds:           credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f9b0501521737d6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3199 
			Secure:          mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db02e36e353d0cc7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3460 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #943b3ccb481abbbb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3462 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42a630e2f7b4de60 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3464 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3923f62e00ec2e1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3567 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b2df53ea6672908 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3569 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0514227716542594 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3571 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bebf166182bcb55 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3637 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #629ae31c3087872e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3639 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99ec77540a764f7b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3641 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eed5707b747628d2 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3709 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #336dde78716bed88 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3711 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4a7d72f03958790 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3713 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a933896a533347b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3832 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30e542c757ed7f45 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3834 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15f1e22a82d16fa2 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3836 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb024ff57cf332f7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3923 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #589f21772c0e2ed0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3925 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ca3db45c10c4657 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:3927 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9da5419755ae644 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4020 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b446a054f528b4a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4022 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c043b23ca1d9a765 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4024 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf1ca65ca735f21d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4104 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4082238075944d0f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4106 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #921e616f9c9c7359 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4108 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cddb02b3a5a948f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4240 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9610c6a221dee95 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4242 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6e218c04711c000 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4244 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0dd57acdb0a7c2d1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4346 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44d5f375a247e0a5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4348 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35fdb6fa023ef3e4 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4350 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f84fde074b4194b2 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:4431 
	srcFile, err := os.Open(fName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b65ef1d991f14d43 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:4438 
	tmpFile, err := os.Create(fName + ".gtar")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d9315c36d25d9f4 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4516 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6254e08d1d181976 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4518 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #103bf20bd4cc107c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4520 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16f89b96e8bf0601 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4617 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3799fbb74ddaf90 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4619 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e9a6c71dadd8d3b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4621 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #705312bb555e38de — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4719 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c413307f9543766 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4721 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc30b47a5e3e9a07 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4723 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e18fc064785c0a72 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4792 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5359bf66958973a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4794 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a7f18c527398200 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4796 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fac6487bfbf431a9 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4976 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10bf96871d8d86cd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4978 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5dacbd582a6a07a5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:4980 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d457f117c5c749e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5146 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3449a95b1eb602a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5148 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b153e5300589c98d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5150 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1147599d931ee93 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5324 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bf61d5002f138cc — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5326 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d8ca2bd39719e53 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5328 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc54222c59052398 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5444 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c20a20fcde34a656 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5446 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4087c9900ee61e2 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5448 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e11811f80ccb43f — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:5568 
	f, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b8b3e10888eedb7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5587 
	transport, err := minio.DefaultTransport(mustParseBool(os.Getenv(enableHTTPS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #507cd60c64718899 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5624 
	if mustParseBool(os.Getenv(enableHTTPS)) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a825f6498a1b8dee — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5630 
	expectedLocation := scheme + os.Getenv(serverEndpoint) + "/" + bucketName + "/" + objectName

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b383ef1a907ff3e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5631 
	expectedLocationBucketDNS := scheme + bucketName + "." + os.Getenv(serverEndpoint) + "/" + objectName

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #424c204e80c5e626 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5666 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12d5ca02fc7af093 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5668 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4794f96ebcd3117 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5670 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38bf85c5abca9ab7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5861 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #823ea9e332702ee0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5863 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ceaccc016e2294e8 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:5865 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7984f27738662327 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6044 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c101235cfd0e492 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6046 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a02f5381424c313c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6048 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d02824afd1ca34a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6225 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8acc12ea9cbaaa3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6227 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf39fda101035f0a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6229 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fe8915784683303 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6409 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e822e42ae2b54cee — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6411 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02a77b0f7fd5d002 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6413 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06b443dbd05484c8 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6594 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2938c32ddf416a58 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6596 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4a702b6716a7108 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6598 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba5f6401a093ec7f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6704 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #189ec22f1f06533f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6706 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c5494fb2940768b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6708 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60cd665e6e7bb2ed — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:6766 
		file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7db7024fba600091 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6827 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96fc6bc1e50fc33f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6829 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfa8f975572960b1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6831 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84308cabc68cd857 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6935 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7399791944eb8a32 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6937 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c960b145a8d9ee95 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:6939 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45370d6346a00e62 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:6996 
		file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a98188f328c9120 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7051 
	if os.Getenv("NOTIFY_BUCKET") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ae982242d508c62 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7052 
		os.Getenv("NOTIFY_SERVICE") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #326e5b0b98ac4ec5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7053 
		os.Getenv("NOTIFY_REGION") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82f5a790e952b931 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7054 
		os.Getenv("NOTIFY_ACCOUNTID") == "" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #075c2d185df18168 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7055 
		os.Getenv("NOTIFY_RESOURCE") == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41b6181a05c4fc6f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7063 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #373017fe5124b4f5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7065 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31b1082ca1a30387 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7067 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcfba498e70458fe — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7080 
	bucketName := os.Getenv("NOTIFY_BUCKET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7dc696daabd7ae5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7083 
	topicArn := notification.NewArn("aws", os.Getenv("NOTIFY_SERVICE"), os.Getenv("NOTIFY_REGION"), os.Getenv("NOTIFY_ACCOUNTID"), os.Getenv("NOTIFY_RESOURCE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8126cb80cb374650 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7158 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #495cfd43a7326923 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7160 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #813de54ed163a9fd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7162 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d431e20597b3a8f — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:7192 
	file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #882a0859ca74aedb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7516 
	transport, err := minio.DefaultTransport(mustParseBool(os.Getenv(enableHTTPS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31f0c719b9bdf56d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7846 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a11057c396c963a3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7848 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d8f02d4ac8c8ea8 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7850 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f90e8b1f22d79f64 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7942 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab1743b8653b1a82 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7944 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b52dae8ea82d7820 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:7946 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f204f6aa393ef25 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:7973 
		tempfile, err = os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9be6fc6e07f4f0ef — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8065 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #001363a0e8ad59ef — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8067 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50984b1ace2b6b41 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8069 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d16d81ffd5f8e78 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8125 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c07653d311a3ad8b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8127 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ee96b21e5c96116 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8129 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6095f4dd78e73033 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8216 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42169c8d2092fb3b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8218 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5f2f5c9e30a0b61 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8220 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9ddcc87ccca21e3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8377 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7844ee69db24c313 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8379 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93712982aa82ed87 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8381 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c82a99c6b6165cea — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8440 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #518f51c2c078876c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8442 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #004831ef81ae9836 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8444 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37722cbdedd55549 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8595 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db046096e31f200a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8597 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a1c0ee9f10e4aba — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8599 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b5d7e7a332df453 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8757 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9a23a90c6d1713c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8759 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cae814fa2b3c2cd0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8761 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1393131607f7e85 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8973 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbd04174094f2f56 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8975 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7d0a3ad0452b35a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:8977 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcb76a05cc0d9bdb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9071 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5964504e1de783c0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9073 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44354c38ca0ff1d3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9075 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #680d9b04e7cafd64 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9093 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b26b90188b54f5bd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9095 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a2a0416dce54e62 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9097 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bccfeb49e2a7c562 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9354 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e838e1b23c77a71a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9356 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea08d69420f24f34 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9358 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2aa88fec5e36c745 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9381 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f15f6f8283763a89 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9383 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9dbbfb4a82ca7a7f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9385 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22cfdc1f8af9834a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9409 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d413e366866a4c72 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9411 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7cccc75d4400fce — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9413 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #575511ee20d666fc — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9436 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #920cbf375a84e533 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9438 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9c36bdd6d05477a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9440 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6449906b61534997 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9464 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccd82999ed875438 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9466 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0efb60417473e1f6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9468 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23c28288484adae1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9492 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ed1968a7a41ae1f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9494 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb6e349b9846ba48 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9496 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d15689284818c6ae — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9520 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #baf0c72e8b4da3a6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9522 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a63217e25b386b2 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9524 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc0d1ed4ac160add — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9548 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a6cc5ef063e0598 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9550 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #859f8c588c279f54 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9552 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a5d225c523229b5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9576 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33c804a77942fb88 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9578 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #591cddc9f2881f80 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9580 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b93737ca4077e81b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9604 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e5b24ddb77b9c15 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9606 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd26c1daf9b27d75 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9608 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #084be93c356cf165 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9631 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cadbb2a0aa50a6c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9633 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa43b1d03b15b554 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9635 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a22636942eac7cb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9691 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b84456c1f77fb759 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9693 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #805d62999793ff72 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9695 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f15d555c209a1aec — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9889 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #886a4b2490a19075 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9891 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92c182f1638a9d30 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:9893 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6588e41d6cd0f89 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10067 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30aed8480c11d2dd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10069 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e956ea3640faa70 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10071 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55d99c17045689c6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10244 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60a17421199250cb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10246 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56a0dc4b34e628db — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10248 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1e5bf8b731ef762 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10424 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3349c305b0b1ccfc — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10426 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4ab275e6574f26c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10428 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b86d1082213eff4 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10599 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da9b78f1e94fda6d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10601 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61835c548e443c89 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10603 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7df613b632137f28 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10770 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #862efdfe4820b0f4 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10772 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #680f75b0cd28d1e2 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10774 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72859ffe5f9376ee — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10943 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfc2d60e94e42747 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10945 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b990b131e279318c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:10947 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b38c6d885b133c1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11119 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4fae0cacb14c53e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11121 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60723069ee3d59cc — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11123 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40d97db0780d86fd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11291 
	client, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16f3c1750e4af43c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11293 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13c167fe5b66ebd0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11295 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73ad90363f020580 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11465 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdd2655eb151c121 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11467 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #202d8ceeaa2c196a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11469 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a90e6ec1b678a6e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11642 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6181c9f867ffd24 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11644 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58f2abbb4755ce8d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11646 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbdc5b8f6f0fbb14 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11665 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d00bbfec39bc5b33 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11667 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6288b4f66712c3ac — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11669 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7f083f3c548b852 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11753 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45e268145dd80be5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11755 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28d0c1bea34d8b14 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11757 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1091baa08197189a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11796 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e63ac31da988e9d5 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11798 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbe1b992614a52f7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11799 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9641ce6c0f4ebfde — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11926 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e35d658aeaab1f93 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11928 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f297e404d1f535f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:11930 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ddda29f47f705437 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12002 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80cbe6fe9eacf09b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12004 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39ac21aa85d5db73 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12006 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f05d53df4c69499 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12093 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64f2aaaa4cb5dc09 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12095 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a4f522f0476d637 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12097 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5f8754481a4a8f1 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12155 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f8d57e7886376ed — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12157 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32bd84400d015437 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12159 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dabdb2cb63380ffb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12178 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e200029ca27141c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12180 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f12301cb29f772c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12182 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #735786ddb64ec54a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12204 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0d4f849cea8f411 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12206 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14e6742ae5cbe70e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12207 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9cfaf8ab3497848 — Filesystem access.
pkgs/go/[email protected]/functional_tests.go:12241 
	file, err := os.Create(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db913c9c600ee159 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12455 
	transport, err := minio.DefaultTransport(mustParseBool(os.Getenv(enableHTTPS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3411388eb6c5c6c2 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12665 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0cc5439dc157c30 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12667 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #239ffe5fa93bd3bd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12669 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4780f3f0850b7fd — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12768 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3ef2e1bf4c5f657 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12770 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0843952aed078776 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12772 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #839a128f70909de6 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12857 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f34e1ce17a76c89 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12859 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1a766b946e5b143 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12861 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b53e85e5f49826b — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12967 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9afebc85f238cecb — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12969 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #890b5576396741c0 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:12971 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebb9e745bb2694d3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13044 
	if os.Getenv(serverEndpoint) != "s3.amazonaws.com" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aba3b29efcc85e36 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13143 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be68c07c04da6515 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13145 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fbfe359a5ff4b7d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13147 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6df02008e3bbfc0f — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13218 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6125884993bb67a — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13220 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b09430846eedbc15 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13222 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af9fd58322212e97 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13319 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b00e12d79b8649d3 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13321 
			Creds:     credentials.NewStaticV2(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04fda94b21c24302 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13323 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4894d13c83a62dbf — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13408 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42bf7fbe47671347 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13410 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #556a9a7a7c2a788d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13412 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47ee25b62a44414c — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13509 
	c, err := minio.New(os.Getenv(serverEndpoint),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f1ab5b97d9a7f7e — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13511 
			Creds:     credentials.NewStaticV4(os.Getenv(accessKey), os.Getenv(secretKey), ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc3993ceda3ca257 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13513 
			Secure:    mustParseBool(os.Getenv(enableHTTPS)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97a05c41bd459b1d — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13654 
	tls := mustParseBool(os.Getenv(enableHTTPS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b72a70e9688aaa9 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13655 
	kms := mustParseBool(os.Getenv(enableKMS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6ce6218706432a7 — Environment-variable access.
pkgs/go/[email protected]/functional_tests.go:13656 
	if os.Getenv(enableKMS) == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be8dc63ada6a18a0 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:44 
	id := os.Getenv("AWS_ACCESS_KEY_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e2de8c1794a91da — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:46 
		id = os.Getenv("AWS_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6bc333d513ce524 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:49 
	secret := os.Getenv("AWS_SECRET_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7884dcf3d6959577 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:51 
		secret = os.Getenv("AWS_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3540ed43eb68e25 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_aws.go:63 
		SessionToken:    os.Getenv("AWS_SESSION_TOKEN"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e08b9376d4f044a3 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:45 
	id := os.Getenv("MINIO_ROOT_USER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a74196843ebc097 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:46 
	secret := os.Getenv("MINIO_ROOT_PASSWORD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e87244de47b77b1 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:50 
		id = os.Getenv("MINIO_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e960ff646c343ec — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/env_minio.go:51 
		secret = os.Getenv("MINIO_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1a7cda6d62ef8a5 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_aws_credentials.go:78 
		p.Filename = os.Getenv("AWS_SHARED_CREDENTIALS_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ead520b54d173b76 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_aws_credentials.go:88 
		p.Profile = os.Getenv("AWS_PROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6110d0c14d18f25 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:63 
		if value, ok := os.LookupEnv("MINIO_SHARED_CREDENTIALS_FILE"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4630a9d4d76a374e — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:78 
		p.Alias = os.Getenv("MINIO_ALIAS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60bca9508d6ac933 — Filesystem access.
pkgs/go/[email protected]/pkg/credentials/file_minio_client.go:124 
	configBytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce32a54990d30f31 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:104 
	token := os.Getenv("AWS_CONTAINER_AUTHORIZATION_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95f496e6da76cc01 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:109 
	tokenFile := os.Getenv("AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd5ffdc75788ca08 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:114 
	relativeURI := os.Getenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #caf288640db76c53 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:119 
	fullURI := os.Getenv("AWS_CONTAINER_CREDENTIALS_FULL_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55adc7a53ca39be2 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:124 
	identityFile := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68b828bebc04da31 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:129 
	roleArn := os.Getenv("AWS_ROLE_ARN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53a1407277bc9c3f — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:134 
	roleSessionName := os.Getenv("AWS_ROLE_SESSION_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dbbafadf3e45ab90 — Environment-variable access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:139 
	region := os.Getenv("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17faf94fe0422c2d — Filesystem access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:166 
				token, err := os.ReadFile(identityFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c45b9c94103defb5 — Filesystem access.
pkgs/go/[email protected]/pkg/credentials/iam_aws.go:320 
		bytes, err := os.ReadFile(tokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #146d28bb403232f1 — Environment-variable access.
pkgs/go/[email protected]/transport.go:73 
		if f := os.Getenv("SSL_CERT_FILE"); f != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c3d26482943b554 — Filesystem access.
pkgs/go/[email protected]/transport.go:75 
			data, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/peterstace/simplefeatures

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #7f4259ae273922bb — Filesystem access.
pkgs/go/[email protected]/internal/benchmarkreport/main.go:17 
	buf, err := os.ReadFile(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/prometheus/client_golang

go dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #c0e068be95db4ce4 — Filesystem access.
pkgs/go/[email protected]/prometheus/collectors/gen_go_collector_set.go:105 
	if err := os.WriteFile(fname, result, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #159145b2661c865d — Filesystem access.
pkgs/go/[email protected]/prometheus/gen_go_collector_metrics_set.go:102 
	if err := os.WriteFile(fname, result, 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32cded34ae9c994e — Filesystem access.
pkgs/go/[email protected]/prometheus/process_collector.go:166 
		content, err := os.ReadFile(pidFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/prometheus/common

go dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #67cad6f14e25fad3 — Filesystem access.
pkgs/go/[email protected]/config/generate.go:172 
	if err := os.WriteFile(fmt.Sprintf("%s.crt", path), b.Bytes(), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9d316a4669a5101 — Filesystem access.
pkgs/go/[email protected]/config/generate.go:181 
	if err := os.WriteFile(fmt.Sprintf("%s.key", path), b.Bytes(), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cb2700d9c47ee84 — Filesystem access.
pkgs/go/[email protected]/config/generate.go:241 
	if err := os.WriteFile("testdata/tls-ca-chain.pem", b.Bytes(), 0o644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66fe8ba6fa6151a2 — Filesystem access.
pkgs/go/[email protected]/config/headers.go:87 
			_, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e35d8aaeb5155524 — Filesystem access.
pkgs/go/[email protected]/config/headers.go:125 
			b, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b1a3c1cbe3f115c — Filesystem access.
pkgs/go/[email protected]/config/http_config.go:286 
	content, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f92191c1ea57392 — Filesystem access.
pkgs/go/[email protected]/config/http_config.go:730 
	fileBytes, err := os.ReadFile(s.file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/sbinet/npyio

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #764ed95e60324ef8 — Filesystem access.
pkgs/go/[email protected]/ci/run-tests.go:45 
	f, err := os.Create("coverage.txt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e756dd65aa900eb1 — Filesystem access.
pkgs/go/[email protected]/ci/run-tests.go:81 
			profile, err := ioutil.ReadFile("profile.out")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a43236cb7b41102e — Filesystem access.
pkgs/go/[email protected]/cmd/npyio-ls/main.go:33 
		f, err := os.Open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7073bfa8ba1be959 — Filesystem access.
pkgs/go/[email protected]/npz/reader.go:47 
	r, err := os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #310522d5282a1993 — Filesystem access.
pkgs/go/[email protected]/npz/writer.go:57 
	w, err := os.Create(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/shirou/gopsutil/v4

go dependency
expand_more 59 low-confidence finding(s)
low env_fs dependency Excluded from app score #3f8c632f81fb7c0b — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu_plan9.go:22 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41a3260c668ebdfd — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:512 
	if f, err := os.Open(udevDataPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95dfcda9b4592f88 — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:544 
	model, _ := os.ReadFile(filepath.Join(devicePath, "model"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d50ebf2f49d64cb — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:545 
	serial, _ := os.ReadFile(filepath.Join(devicePath, "serial"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #692a2a5c42e11726 — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:557 
		dmname, err := os.ReadFile(dmnameFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7f3f128e88e3c45 — Filesystem access.
pkgs/go/[email protected]/disk/disk_solaris.go:51 
	f, err := os.Open(_MNTTAB)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #625c60490c145e64 — Filesystem access.
pkgs/go/[email protected]/host/host_darwin.go:56 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4d1485ebfe66201 — Filesystem access.
pkgs/go/[email protected]/host/host_freebsd.go:52 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b4a40a49d6e99a0 — Filesystem access.
pkgs/go/[email protected]/host/host_freebsd.go:109 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2743fd6df4be4a21 — Filesystem access.
pkgs/go/[email protected]/host/host_linux.go:84 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bbf31bc5896a952 — Filesystem access.
pkgs/go/[email protected]/host/host_openbsd.go:63 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a808e2e5e9ffd8c1 — Filesystem access.
pkgs/go/[email protected]/host/host_solaris.go:104 
	b, err := os.ReadFile("/etc/release")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2cc027fcf1c1edc8 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:93 
		return os.ReadFile(fpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f565f54fea7cd09 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:104 
	content, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b961d4b9bde97f07 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:120 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #569506aac27e259f — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:148 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0c0d97aa47310b5 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:233 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07e0cb1b65f25c83 — Environment-variable access.
pkgs/go/[email protected]/internal/common/common.go:351 
		value = os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55a97628c0cb3f9a — Environment-variable access.
pkgs/go/[email protected]/internal/common/common.go:362 
	value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb465bbf738e8912 — Filesystem access.
pkgs/go/[email protected]/internal/common/common_linux.go:27 
	f, err := os.Open(HostProcWithContext(ctx))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81189f126dc4e619 — Filesystem access.
pkgs/go/[email protected]/load/load_linux.go:79 
	out, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d46f673c4f357c76 — Filesystem access.
pkgs/go/[email protected]/load/load_linux.go:121 
	line, err := os.ReadFile(loadavgFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06df9126595f7720 — Filesystem access.
pkgs/go/[email protected]/mem/mem_linux.go:464 
	f, err := os.Open(swapsFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c2aa175568357f3 — Environment-variable access.
pkgs/go/[email protected]/mem/mem_plan9.go:20 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b04fc5726ee5c79 — Environment-variable access.
pkgs/go/[email protected]/mem/mem_plan9.go:42 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b8423750c2e2ccf — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:475 
	f, err := os.Open(dir)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60e91edd1ee1d8d8 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:518 
	d, err := os.Open(common.HostProcWithContext(ctx))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ecccfb14ecfbeb46 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:562 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0a6ff8e79e96219 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:681 
	contents, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3e067838e0c1f2b — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:742 
	contents, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd6959ce997b57ac — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:139 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1895a647f0702354 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:348 
		statContents, err := os.ReadFile(statFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #599c676d8993ddfc — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:399 
	contents, err := os.ReadFile(smapsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c556ce2218efdcc4 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:494 
	environContent, err := os.ReadFile(environPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #179a9f6b42a538e9 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:521 
	d, err := os.Open(limitsFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0aa96d85e2d89126 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:614 
	d, err := os.Open(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8f781e7e42c8a95 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:678 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fca89d471eae757 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:692 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13794967ed36752d — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:715 
	ioline, err := os.ReadFile(ioPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e4f0596c26c56bf — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:755 
	contents, err := os.ReadFile(memPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee14ddb731b0c772 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:816 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edbb79b6ad368b80 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:833 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ebdf9b77e4dcfcf — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:1040 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2fba2dad37b8955 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:1165 
	d, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a21b6f3820d94412 — Filesystem access.
pkgs/go/[email protected]/process/process_posix.go:29 
	d, err := os.Open("/dev")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b532b222b9a39b4 — Filesystem access.
pkgs/go/[email protected]/process/process_posix.go:46 
	ptsd, err := os.Open("/dev/pts")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba3e14efd3cb87a5 — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:203 
	d, err := os.Open(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75bf1432fbf90d4d — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:235 
	exe, err := os.ReadFile(execNamePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96c5399cc51b3186 — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:245 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37233d1150b924a4 — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:259 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7608b58c3462069 — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:281 
	d, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50cf29e628d4b5b0 — Filesystem access.
pkgs/go/[email protected]/sensors/ex_linux.go:52 
		if raw, _ = os.ReadFile(basepath + "_label"); len(raw) != 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cee05d9519d6d66 — Filesystem access.
pkgs/go/[email protected]/sensors/ex_linux.go:58 
		if raw, err = os.ReadFile(filepath.Join(directory, "name")); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b60f19af61ae6d9 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:39 
			name, err := os.ReadFile(filepath.Join(file, "type"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05db93d42c0cbae9 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:45 
			current, err := os.ReadFile(filepath.Join(file, "temp"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58763c3212892c83 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:89 
		if raw, _ = os.ReadFile(basepath + "_label"); len(raw) != 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23b4253fc15b01d3 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:95 
		if raw, err = os.ReadFile(filepath.Join(directory, "name")); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36c3157a68dcd3e0 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:107 
		if raw, err = os.ReadFile(file); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de513498d58a5ecf — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:163 
	if raw, err = os.ReadFile(filename); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/sirupsen/logrus

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #d25f164f7ed2fc19 — Environment-variable access.
pkgs/go/[email protected]/text_formatter.go:121 
		switch force, ok := os.LookupEnv("CLICOLOR_FORCE"); {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d380cccf1f609c94 — Environment-variable access.
pkgs/go/[email protected]/text_formatter.go:124 
		case ok && force == "0", os.Getenv("CLICOLOR") == "0":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common

go dependency
expand_more 11 low-confidence finding(s)
low env_fs dependency Excluded from app score #331d6a0559b83506 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/env_provider.go:31 
	secretId, ok1 := os.LookupEnv(p.secretIdENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84c8ebbd365af427 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/env_provider.go:32 
	secretKey, ok2 := os.LookupEnv(p.secretKeyENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8717502411c3e221 — Filesystem access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/ini.go:17 
	data, err = ioutil.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dff557abdf907b1f — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/oidc_role_arn_provider.go:59 
		reg := os.Getenv("TKE_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #056e8d6ab2e6ba65 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/oidc_role_arn_provider.go:64 
		providerId := os.Getenv("TKE_PROVIDER_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d555643ffa83306 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/oidc_role_arn_provider.go:69 
		tokenFile := os.Getenv("TKE_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #920279176cd9ac5c — Filesystem access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/oidc_role_arn_provider.go:73 
		tokenBytes, err := ioutil.ReadFile(tokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c60e724c35ef772 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/oidc_role_arn_provider.go:78 
		roleArn := os.Getenv("TKE_ROLE_ARN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db9c2816e7c3ab18 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/profile_provider.go:32 
		return os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d820d15386e12a8 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/profile_provider.go:35 
	return os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10ce2ae31f790ca8 — Environment-variable access.
pkgs/go/github.com_tencentcloud_tencentcloud-sdk-go_tencentcloud_common@v1.0.865/profile_provider.go:62 
	path, ok := os.LookupEnv(EnvCredentialFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/tikv/client-go/v2

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #234b6b621d28df5c — Filesystem access.
pkgs/go/github.com_tikv_client-go_v2@v2.0.8-0.20260610031342-e999c1f9c7c3/config/security.go:69 
		ca, err = os.ReadFile(s.ClusterSSLCA)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/twpayne/go-geom

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #cda0fd8dde962c6a — Filesystem access.
pkgs/go/[email protected]/internal/cmd/parse-igc/main.go:14 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/zilliztech/woodpecker

go dependency
expand_more 39 low-confidence finding(s)
low env_fs dependency Excluded from app score #06c007663a35efdc — Filesystem access.
pkgs/go/[email protected]/cmd/external/user_config.go:81 
		data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d993b90b8d8a4292 — Environment-variable access.
pkgs/go/[email protected]/cmd/main.go:185 
			"admin_port": os.Getenv("METRICS_PORT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2020ac6c5554095a — Filesystem access.
pkgs/go/[email protected]/cmd/wpcli/cmd/ctx.go:81 
			if err := os.WriteFile(path, data, 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67a351e4dbcb7f19 — Filesystem access.
pkgs/go/[email protected]/cmd/wpcli/cmd/profile.go:57 
			f, err := os.Create(outputFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e0fba65d9b12240 — Environment-variable access.
pkgs/go/[email protected]/cmd/wpcli/cmd/resolver.go:39 
	ctx.Endpoint = resolveEndpoint(Globals.Endpoint, os.Getenv("WOODPECKER_ENDPOINT"), ctx.Endpoint)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ae85f1001373f7c — Filesystem access.
pkgs/go/[email protected]/cmd/wpcli/config/cli_config.go:47 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #266adc68ae45da88 — Environment-variable access.
pkgs/go/[email protected]/cmd/wpcli/config/cli_config.go:87 
	if p := os.Getenv("WOODPECKER_CLI_CONFIG"); p != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d934de6e86b995d0 — Environment-variable access.
pkgs/go/[email protected]/cmd/wpcli/config/cli_config.go:90 
	if p := os.Getenv("XDG_CONFIG_HOME"); p != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44e5c8097d6f7d39 — Filesystem access.
pkgs/go/[email protected]/common/config/configuration.go:436 
		data, err := os.ReadFile(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #463cec1f8c02ccf5 — Filesystem access.
pkgs/go/[email protected]/common/etcd/etcd_util.go:88 
	caCert, err := os.ReadFile(caCertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f92f2d97fdbdc77f — Environment-variable access.
pkgs/go/[email protected]/common/hardware/container_linux.go:62 
	memoryStr := os.Getenv("MEM_LIMIT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b361e91e2feac4ff — Environment-variable access.
pkgs/go/[email protected]/common/http/management/env_handler.go:47 
		for _, kv := range os.Environ() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2656a43ae81bcf0c — Environment-variable access.
pkgs/go/[email protected]/common/http/management/env_handler.go:65 
				GOGC:         os.Getenv("GOGC"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27dbcf8ed4263fd2 — Environment-variable access.
pkgs/go/[email protected]/common/http/server.go:100 
		pprofEnableKey := os.Getenv(PprofEnableEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f300ec4d24dcb131 — Environment-variable access.
pkgs/go/[email protected]/common/http/server.go:277 
	port := os.Getenv(ListenPortEnvKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9d92d68f405cfb4 — Environment-variable access.
pkgs/go/[email protected]/common/metrics/service_metrics.go:36 
	if v := os.Getenv("NODE_NAME"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dab43722e66a4791 — Environment-variable access.
pkgs/go/[email protected]/common/objectstorage/azure_object_storage.go:212 
		if os.Getenv("AZURE_FEDERATED_TOKEN_FILE") != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #888e758e738891fc — Environment-variable access.
pkgs/go/[email protected]/common/objectstorage/azure_object_storage.go:214 
				ClientID:      os.Getenv("AZURE_CLIENT_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c770cde85ba54fa7 — Environment-variable access.
pkgs/go/[email protected]/common/objectstorage/azure_object_storage.go:215 
				TenantID:      os.Getenv("AZURE_TENANT_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df8956c68360d2d8 — Environment-variable access.
pkgs/go/[email protected]/common/objectstorage/azure_object_storage.go:216 
				TokenFilePath: os.Getenv("AZURE_FEDERATED_TOKEN_FILE"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1f9373695fb62c5 — Environment-variable access.
pkgs/go/[email protected]/common/objectstorage/azure_object_storage.go:219 
			clientID := os.Getenv("AZURE_CLIENT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e298d27d294069d7 — Environment-variable access.
pkgs/go/[email protected]/common/objectstorage/azure_object_storage.go:235 
		connectionString := os.Getenv("AZURE_STORAGE_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca7598a468280c22 — Environment-variable access.
pkgs/go/[email protected]/common/topology/topology_utils.go:13 
	if v := os.Getenv(key); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8621448ee2b3fb92 — Filesystem access.
pkgs/go/[email protected]/server/delete_marker.go:71 
	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d781ab1cbd1bee06 — Filesystem access.
pkgs/go/[email protected]/server/delete_marker.go:92 
	dir, err := os.Open(filepath.Dir(p))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e17351c6a24c4d4 — Filesystem access.
pkgs/go/[email protected]/server/delete_marker.go:130 
		data, rerr := os.ReadFile(path) //nolint:gosec

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44204382f3d2e4ed — Filesystem access.
pkgs/go/[email protected]/server/lifecycle.go:181 
	data, err := os.ReadFile(m.stateFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91cf6511aeab7921 — Filesystem access.
pkgs/go/[email protected]/server/lifecycle.go:221 
	if err := os.WriteFile(tmpPath, data, 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d4f9b728cc9685e — Filesystem access.
pkgs/go/[email protected]/server/storage/disk/reader_impl.go:89 
	file, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #528d517f7cceea61 — Filesystem access.
pkgs/go/[email protected]/server/storage/disk/writer_impl.go:216 
		file, err = os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d577cf7cb6fd640c — Filesystem access.
pkgs/go/[email protected]/server/storage/disk/writer_impl.go:230 
		file, err = os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #342065c2d5b423f5 — Filesystem access.
pkgs/go/[email protected]/server/storage/disk/writer_impl.go:1074 
	fenceFile, err := os.Create(fenceFlagPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0efdf8f61acd3adc — Filesystem access.
pkgs/go/[email protected]/server/storage/disk/writer_impl.go:1140 
	file, err := os.Open(w.segmentFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2512b7173df80cf — Filesystem access.
pkgs/go/[email protected]/server/storage/disk/writer_impl.go:1461 
	if infoFile, err := os.OpenFile(s.lockFilePath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #494a06c28048c30f — Filesystem access.
pkgs/go/[email protected]/server/storage/stagedstorage/reader_impl.go:110 
	file, err := os.Open(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0affb922232ae7d — Filesystem access.
pkgs/go/[email protected]/server/storage/stagedstorage/writer_impl.go:256 
		file, err = os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ff4b163d1661432 — Filesystem access.
pkgs/go/[email protected]/server/storage/stagedstorage/writer_impl.go:260 
		file, err = os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c842e3ce41548a03 — Filesystem access.
pkgs/go/[email protected]/server/storage/stagedstorage/writer_impl.go:1607 
	file, err := os.Open(w.segmentFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3a5c6c859de038d — Filesystem access.
pkgs/go/[email protected]/server/storage/stagedstorage/writer_impl.go:1765 
	file, err := os.Open(w.segmentFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.etcd.io/etcd/client/v3

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #510eb301ac31ffbd — Environment-variable access.
pkgs/go/[email protected]/logger.go:30 
	if os.Getenv("ETCD_CLIENT_DEBUG") != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b592c1b6c34fff5 — Environment-variable access.
pkgs/go/[email protected]/logger.go:49 
	envLevel := os.Getenv("ETCD_CLIENT_DEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c2c118a5ece09d3 — Filesystem access.
pkgs/go/[email protected]/snapshot/v3_snapshot.go:61 
	f, err = os.OpenFile(partpath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileutil.PrivateFileMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #277ecae4b6d41b83 — Filesystem access.
pkgs/go/[email protected]/yaml/config.go:45 
	b, err := ioutil.ReadFile(fpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.etcd.io/etcd/server/v3

go dependency
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #d39698fa57906a50 — Filesystem access.
pkgs/go/[email protected]/auth/options.go:73 
		opts.PublicKey, err = ioutil.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ce7f94a95839d00 — Filesystem access.
pkgs/go/[email protected]/auth/options.go:80 
		opts.PrivateKey, err = ioutil.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c659b7684528437a — Filesystem access.
pkgs/go/[email protected]/embed/config.go:545 
	b, err := ioutil.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3a5db93c9eb5c7e — Environment-variable access.
pkgs/go/[email protected]/etcdmain/config.go:361 
		cfg.configFile = os.Getenv(flags.FlagToEnv("ETCD", "config-file"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21da45d177fdcce2 — Environment-variable access.
pkgs/go/[email protected]/etcdmain/config.go:405 
	if verVal := os.Getenv(verKey); verVal != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #839f0232427c4495 — Filesystem access.
pkgs/go/[email protected]/etcdmain/config.go:478 
	b, rerr := ioutil.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ac24cfa9f9503b3 — Filesystem access.
pkgs/go/[email protected]/etcdmain/etcd.go:287 
	b, err := ioutil.ReadFile(clusterfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aaf0014aa50e7a6a — Environment-variable access.
pkgs/go/[email protected]/etcdmain/etcd.go:481 
	if env, ok := os.LookupEnv("ETCD_UNSUPPORTED_ARCH"); ok && env == runtime.GOARCH {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #312ce30771bd68e1 — Filesystem access.
pkgs/go/[email protected]/etcdmain/grpc_proxy.go:579 
		caCert, err := ioutil.ReadFile(ca)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5410a7ac66941341 — Filesystem access.
pkgs/go/[email protected]/etcdserver/api/snap/snapshotter.go:163 
	b, err := ioutil.ReadFile(snapname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #943865d891046213 — Filesystem access.
pkgs/go/[email protected]/etcdserver/api/snap/snapshotter.go:218 
	dir, err := os.Open(s.dir)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bee1ac1349a062b — Filesystem access.
pkgs/go/[email protected]/etcdserver/api/snap/snapshotter.go:275 
	dir, err := os.Open(s.dir)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c3d8d2618727927 — Environment-variable access.
pkgs/go/[email protected]/mvcc/backend/verify.go:59 
	return os.Getenv(ENV_VERIFY) == ENV_VERIFY_ALL_VALUE || os.Getenv(ENV_VERIFY) == ENV_VERIFY_LOCK

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #793093f7a5912c3d — Environment-variable access.
pkgs/go/[email protected]/verify/verify.go:101 
	return os.Getenv(ENV_VERIFY) == ENV_VERIFY_ALL_VALUE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71c57ce1e3299f83 — Environment-variable access.
pkgs/go/[email protected]/verify/verify.go:107 
	previousEnv := os.Getenv(ENV_VERIFY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b8a2e48f52f7796 — Environment-variable access.
pkgs/go/[email protected]/verify/verify.go:117 
	previousEnv := os.Getenv(ENV_VERIFY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26f20c69d0139fa2 — Filesystem access.
pkgs/go/[email protected]/wal/repair.go:68 
			bf, bferr := os.Create(f.Name() + ".broken")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4365fe27171df11 — Filesystem access.
pkgs/go/[email protected]/wal/wal.go:397 
			rf, err := os.OpenFile(p, os.O_RDONLY, fileutil.PrivateFileMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/exporters/jaeger

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #d9dd4b4c46e45e48 — Environment-variable access.
pkgs/go/[email protected]/env.go:40 
	if v, ok := os.LookupEnv(key); ok && v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #6c1d3b2519b37f20 — Environment-variable access.
pkgs/go/go.opentelemetry.io_otel_exporters_otlp_otlptrace_otlptracegrpc@v1.42.0/internal/x/x.go:46 
		vRaw := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #d1ec98dd52cd6892 — Environment-variable access.
pkgs/go/go.opentelemetry.io_otel_exporters_otlp_otlptrace_otlptracehttp@v1.43.0/internal/x/x.go:46 
		vRaw := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/exporters/stdout/stdouttrace

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #b8356a46354bf89d — Environment-variable access.
pkgs/go/[email protected]/internal/x/x.go:46 
		vRaw := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/sdk

go dependency
expand_more 10 low-confidence finding(s)
low env_fs dependency Excluded from app score #167a0a85f306ebe3 — Environment-variable access.
pkgs/go/[email protected]/internal/x/x.go:46 
		vRaw := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17a255b3b68fe513 — Filesystem access.
pkgs/go/[email protected]/resource/container.go:47 
		return os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f8b634ea2e6d338 — Environment-variable access.
pkgs/go/[email protected]/resource/env.go:39 
	attrs := strings.TrimSpace(os.Getenv(resourceAttrKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #022e16c72d2dc4a4 — Environment-variable access.
pkgs/go/[email protected]/resource/env.go:40 
	svcName := strings.TrimSpace(os.Getenv(svcNameKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e91355e6bf9cb0bc — Filesystem access.
pkgs/go/[email protected]/resource/host_id_readfile.go:11 
	b, err := os.ReadFile(filename) // nolint:gosec // false positive

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5dcf714d68af2f3e — Filesystem access.
pkgs/go/[email protected]/resource/os_unix.go:71 
		file, err := os.Open(c)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #453434e21b8e3dd5 — Environment-variable access.
pkgs/go/[email protected]/trace/internal/env/env.go:64 
		value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e91ecc70e280676 — Environment-variable access.
pkgs/go/[email protected]/trace/internal/env/env.go:84 
	value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #744e0af1598c8774 — Environment-variable access.
pkgs/go/[email protected]/trace/sampler_env.go:49 
	sampler, ok := os.LookupEnv(tracesSamplerKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d40709b382d7314 — Environment-variable access.
pkgs/go/[email protected]/trace/sampler_env.go:55 
	samplerArg, hasSamplerArg := os.LookupEnv(tracesSamplerArgKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/trace

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #42dd89ae3441bbd4 — Environment-variable access.
pkgs/go/[email protected]/auto.go:649 
		strV := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.uber.org/atomic

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #d26d513b5a25a163 — Filesystem access.
pkgs/go/[email protected]/internal/gen-atomicint/main.go:75 
		f, err := os.Create(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54a0abff36b115db — Filesystem access.
pkgs/go/[email protected]/internal/gen-atomicwrapper/main.go:157 
		f, err := os.Create(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.uber.org/automaxprocs

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #41b7a81d826cfc47 — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/cgroup.go:56 
	paramFile, err := os.Open(cg.ParamPath(param))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9d25f0b1cf032ab — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/cgroups2.go:129 
	cpuMaxParams, err := os.Open(path.Join(cg.mountPoint, cg.groupPath, cg.cpuMaxFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #170af5df4643c206 — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/mountpoint.go:152 
	mountInfoFile, err := os.Open(procPathMountInfo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69de71aed235f5c7 — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/subsys.go:79 
	cgroupFile, err := os.Open(procPathCGroup)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcdcb5523881337c — Environment-variable access.
pkgs/go/[email protected]/maxprocs/maxprocs.go:100 
	if max, exists := os.LookupEnv(_maxProcsKey); exists {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.uber.org/zap

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #9d091bc143d5ada1 — Environment-variable access.
pkgs/go/[email protected]/internal/ztest/timeout.go:55 
	if v := os.Getenv("TEST_TIMEOUT_SCALE"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/crypto

go dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #e4cd3efbf3f88e0e — Filesystem access.
pkgs/go/[email protected]/acme/autocert/cache.go:50 
		data, err = os.ReadFile(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6076242f063959e5 — Environment-variable access.
pkgs/go/[email protected]/internal/testenv/exec.go:41 
			if s := os.Getenv("GO_TEST_TIMEOUT_SCALE"); s != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c2c624df08fbc64 — Filesystem access.
pkgs/go/[email protected]/ssh/knownhosts/knownhosts.go:411 
		f, err := os.Open(fn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de84ccb406a81297 — Filesystem access.
pkgs/go/[email protected]/x509roots/gen_fallback_bundle.go:48 
		f, err := os.Open(*certDataPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #646d0d18fbc96b14 — Filesystem access.
pkgs/go/[email protected]/x509roots/gen_fallback_bundle.go:136 
	if err := os.WriteFile(*output, formatted, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #285c6bd84f3c71b0 — Filesystem access.
pkgs/go/[email protected]/x509roots/gen_fallback_bundle.go:140 
	if err := os.WriteFile(*derOutput, rawCertsData.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/exp

go dependency
expand_more 24 low-confidence finding(s)
low env_fs dependency Excluded from app score #80f363578d779f3d — Filesystem access.
pkgs/go/[email protected]/cmd/apidiff/main.go:194 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5134be2c328944cd — Filesystem access.
pkgs/go/[email protected]/cmd/apidiff/main.go:215 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e07c795bb1d98608 — Filesystem access.
pkgs/go/[email protected]/cmd/apidiff/main.go:228 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b297f1a088c3b79f — Filesystem access.
pkgs/go/[email protected]/cmd/apidiff/main.go:244 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f39ff07cfef0283f — Environment-variable access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:145 
	ctx := context.WithValue(context.Background(), "env", append(os.Environ(), "GO111MODULE=on"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c778e3649f50835 — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:311 
	m.goModData, err = os.ReadFile(m.goModPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8fc21c84860ef4e — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:373 
				if data, err := os.ReadFile(altGoModPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07e222b1f350f32c — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:513 
	if m.goModData, err = os.ReadFile(m.goModPath); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #101e1e7a7fea7c18 — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:1099 
	if err := os.WriteFile(filepath.Join(dir, "go.mod"), goModData, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #110dbe36420bb677 — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:1103 
	goSumData, err = os.ReadFile(filepath.Join(modRoot, "go.sum"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8212a0181cea92be — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:1107 
	if err := os.WriteFile(filepath.Join(dir, "go.sum"), goSumData, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c89a08450f3fe60f — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:1122 
	if err := os.WriteFile(filepath.Join(dir, "tmp.go"), []byte(fakeImports.String()), 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b67050817e8479e5 — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:1151 
	newGoModData, err := os.ReadFile(goModPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f8cad0a2987c97b — Filesystem access.
pkgs/go/[email protected]/cmd/gorelease/gorelease.go:1190 
		newGoSumData, err := os.ReadFile(goSumPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42f16073c738fa82 — Filesystem access.
pkgs/go/[email protected]/cmd/txtar/txtar.go:129 
		if err := os.WriteFile(fileName, f.Data, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f6efda79c5a6c65 — Filesystem access.
pkgs/go/[email protected]/cmd/txtar/txtar.go:171 
			data, err := os.ReadFile(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #489fbd4692af43f7 — Environment-variable access.
pkgs/go/[email protected]/cmd/txtar/txtar.go:215 
		v, ok := os.LookupEnv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9aeb28d4ebf5711 — Filesystem access.
pkgs/go/[email protected]/ebnflint/ebnflint.go:99 
		f, err := os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f7fa7bc7a9d31b6 — Filesystem access.
pkgs/go/[email protected]/io/i2c/devfs.go:33 
	f, err := os.OpenFile(d.Dev, os.O_RDWR, os.ModeDevice)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ff704b6251d079a — Filesystem access.
pkgs/go/[email protected]/io/spi/devfs.go:71 
	f, err := os.OpenFile(d.Dev, os.O_RDWR, os.ModeDevice)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfd29211957a80ed — Filesystem access.
pkgs/go/[email protected]/mmap/mmap_other.go:51 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99c847dffd8e314d — Filesystem access.
pkgs/go/[email protected]/mmap/mmap_unix.go:84 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63194681dd4540ce — Filesystem access.
pkgs/go/[email protected]/mmap/mmap_windows.go:83 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1df38a6a2c51c483 — Filesystem access.
pkgs/go/[email protected]/trace/internal/testgen/go122/trace.go:29 
	out, err := os.Create(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/net

go dependency
expand_more 28 low-confidence finding(s)
low env_fs dependency Excluded from app score #2dbc39f4400896d8 — Filesystem access.
pkgs/go/[email protected]/html/atom/gen.go:50 
	if err := os.WriteFile(name, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68a48f002959721c — Environment-variable access.
pkgs/go/[email protected]/http/httpproxy/proxy.go:95 
		CGI:        os.Getenv("REQUEST_METHOD") != "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb5243e9371696b0 — Environment-variable access.
pkgs/go/[email protected]/http/httpproxy/proxy.go:101 
		if val := os.Getenv(n); val != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e02d4efc1cf11aa1 — Environment-variable access.
pkgs/go/[email protected]/http2/gotrack.go:21 
var DebugGoroutines = os.Getenv("DEBUG_HTTP2_GOROUTINES") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ea153dfca8aae33 — Environment-variable access.
pkgs/go/[email protected]/http2/h2c/h2c.go:52 
	e := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56d2c08515e049f9 — Filesystem access.
pkgs/go/[email protected]/http2/hpack/gen.go:178 
	if err := os.WriteFile(name, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50dfd52628ca9a10 — Environment-variable access.
pkgs/go/[email protected]/http2/http2.go:53 
	e := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #752d68461f4ed8c4 — Filesystem access.
pkgs/go/[email protected]/internal/iana/gen.go:71 
	if err := os.WriteFile("const.go", b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2b565ce3648f554 — Environment-variable access.
pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:67 
	if keylog := os.Getenv("SSLKEYLOGFILE"); keylog != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83d738be491358a0 — Filesystem access.
pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:68 
		f, err := os.Create(keylog)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #800c48b1b30bcd45 — Environment-variable access.
pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:76 
	testcase := os.Getenv("TESTCASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b233aed3882f131 — Filesystem access.
pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:216 
	f, err := os.Open(filepath.Join(*root, string(req)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca305d994e51c210 — Filesystem access.
pkgs/go/[email protected]/internal/quic/cmd/interop/main.go:267 
	file, err := os.Create(filepath.Join(*output, u.Path[1:]))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36a9633d8641625b — Filesystem access.
pkgs/go/[email protected]/ipv4/gen.go:41 
	f, err := os.Open(defs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #863acdf40ae35d96 — Filesystem access.
pkgs/go/[email protected]/ipv4/gen.go:63 
	if err := os.WriteFile(zsys, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58767186e0a26b24 — Filesystem access.
pkgs/go/[email protected]/ipv4/gen.go:102 
	if err := os.WriteFile("iana.go", b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24bffd2333d93119 — Filesystem access.
pkgs/go/[email protected]/ipv6/gen.go:41 
	f, err := os.Open(defs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c42607e04fce304b — Filesystem access.
pkgs/go/[email protected]/ipv6/gen.go:63 
	if err := os.WriteFile(zsys, b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a30ff5d3292a919e — Filesystem access.
pkgs/go/[email protected]/ipv6/gen.go:102 
	if err := os.WriteFile("iana.go", b, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4854bbfd6439aaa5 — Environment-variable access.
pkgs/go/[email protected]/proxy/proxy.go:138 
		e.val = os.Getenv(n)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #987fa0644452d1ae — Filesystem access.
pkgs/go/[email protected]/publicsuffix/gen.go:275 
	return os.WriteFile(filename, b, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #bdf45d19386c83c9 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/go/[email protected]/publicsuffix/gen.go:279 
	res, err := http.Get(gitCommitURL)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #90b3ae86c375f4be — Filesystem access.
pkgs/go/[email protected]/publicsuffix/gen.go:320 
	if err := os.WriteFile("data/text", []byte(combinedText), 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dac3d37ca64ed31c — Filesystem access.
pkgs/go/[email protected]/publicsuffix/gen.go:333 
	if err := os.WriteFile("data/nodes", nodes, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be7d21d38da4a179 — Filesystem access.
pkgs/go/[email protected]/publicsuffix/gen.go:341 
	if err := os.WriteFile("data/children", children, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bff0df47abe39d0b — Environment-variable access.
pkgs/go/[email protected]/quic/log.go:19 
	s := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98ddefd53b81a5fe — Filesystem access.
pkgs/go/[email protected]/quic/qlog/qlog.go:181 
		w, err = os.OpenFile(filepath.Join(opts.Dir, filename), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0666)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97bbd9c63704aa7b — Filesystem access.
pkgs/go/[email protected]/webdav/file.go:95 
	f, err := os.OpenFile(name, flag, perm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/oauth2

go dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #b9ec025f92dab57f — Environment-variable access.
pkgs/go/[email protected]/google/default.go:237 
	if filename := os.Getenv(envVar); filename != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2eb13cbe77076437 — Filesystem access.
pkgs/go/[email protected]/google/default.go:247 
	if b, err := os.ReadFile(filename); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d995c53ad8926366 — Environment-variable access.
pkgs/go/[email protected]/google/default.go:429 
		return filepath.Join(os.Getenv("APPDATA"), "gcloud", f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2ea6f9e16a2cc67 — Filesystem access.
pkgs/go/[email protected]/google/default.go:435 
	b, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4dffb43455eccef2 — Environment-variable access.
pkgs/go/[email protected]/google/externalaccount/executablecredsource.go:98 
	return os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2350c85e3f093bc9 — Environment-variable access.
pkgs/go/[email protected]/google/externalaccount/executablecredsource.go:102 
	return os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4ce5c59994f9bae — Filesystem access.
pkgs/go/[email protected]/google/externalaccount/executablecredsource.go:253 
	file, err := os.Open(cs.OutputFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ddd307cda6c1b07 — Filesystem access.
pkgs/go/[email protected]/google/externalaccount/filecredsource.go:26 
	tokenFile, err := os.Open(cs.File)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4f0a3dfb6f68379 — Filesystem access.
pkgs/go/[email protected]/google/sdk.go:60 
	f, err := os.Open(credentialsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3df3fb2e0962024f — Filesystem access.
pkgs/go/[email protected]/google/sdk.go:75 
		f, err := os.Open(propertiesPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb725c627fe699d8 — Environment-variable access.
pkgs/go/[email protected]/google/sdk.go:182 
		return filepath.Join(os.Getenv("APPDATA"), "gcloud"), nil

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6bfb71d4cc942e2f — Environment-variable access.
pkgs/go/[email protected]/google/sdk.go:193 
	if v := os.Getenv("HOME"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/sys

go dependency
expand_more 59 low-confidence finding(s)
low env_fs dependency Excluded from app score #c4538d17b5aee215 — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu.go:276 
	env := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cd8f0eb6f94fbfc — Filesystem access.
pkgs/go/[email protected]/cpu/hwcap_linux.go:42 
	buf, err := os.ReadFile(procAuxv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abd317d15c15897e — Filesystem access.
pkgs/go/[email protected]/cpu/proc_cpuinfo_linux.go:17 
	f, err := os.Open("/proc/cpuinfo")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b927c7c4a042d3c — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:90 
	goos := os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c66826afc2459da2 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:91 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db1788b1ba94d881 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:93 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #751aa3aedea57ca5 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:98 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #362b2c9c49671318 — Filesystem access.
pkgs/go/[email protected]/plan9/mksyscall.go:127 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad822738c9ceb579 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:443 
		src, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c7ee6320c00c054 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:467 
	f, err := os.Create(mergedFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa0cb5e36454fe2e — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:494 
		err = os.WriteFile(inFile.name, src, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75ea39f06c5e0550 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:182 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9cf617d8bddc93f — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:317 
	if fmtCmd.Stdout, err = os.Create(outputFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81c5b70ecd9e181d — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:337 
	t.env = append(os.Environ(), fmt.Sprintf("%s=%s", "GOOS", GOOS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4441e2b23fd8d18b — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:447 
	if file, err := os.Create(stubsFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17c8d2af81f32a9f — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:482 
	abiFile, err := os.Create(filepath.Join(abiDir, "abi.h"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9ebbfeb7149247e — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:631 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb09c278eb3e54b8 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:756 
	f, err := os.Create(fmt.Sprintf("zptrace_%s_linux.go", archName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60a5281cad4870ca — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:784 
	f, err := os.Create(fmt.Sprintf("zptrace_linux_%s.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c99f5a3d76f794b5 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:819 
	data, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #079dd8d952e40905 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:100 
	goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8c24274e54e41ce — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:101 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b34d9d1519aa711b — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:103 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e035d8712169ba39 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:111 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53cf689bafd0650f — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:117 
	cc := os.Getenv("CC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9480e2b4bff51d8a — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:36 
		in, err := os.ReadFile(inFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f96e1e943cffc10 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:73 
	if err := os.WriteFile(outFileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d84ca1cc14c5fad — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:110 
	if err := os.WriteFile(fileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c2996e2e108299d — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:26 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cc121b41942509d — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:28 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41105c42c270c4cb — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:30 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73dcfe56bfec3c3d — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:32 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e88260e58f99971 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:36 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48ea7165ed87d8b7 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:104 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #218fdef2fbf2c2f5 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:106 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3af5c116b27fef6d — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:115 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02eb1bbf78909c11 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall.go:145 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6186cbb25263cb5 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc.go:100 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8c7ecaafd70bc4d — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:148 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce43724876972f13 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:521 
	err := os.WriteFile("zsyscall_aix_ppc64.go",
		[]byte(fmt.Sprintf(srcTemplate1, cmdLine(), goBuildTags(), pack, imp, textcommon)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39907f53324a76d2 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:532 
	err = os.WriteFile("zsyscall_aix_ppc64_gc.go",
		[]byte(fmt.Sprintf(srcTemplate2, cmdLine(), goBuildTags(), pack, imp, dynimports, linknames, vardecls, textgc)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24851bd6775e8c26 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:541 
	err = os.WriteFile("zsyscall_aix_ppc64_gccgo.go",
		[]byte(fmt.Sprintf(srcTemplate3, cmdLine(), goBuildTags(), pack, cExtern, imp, textgccgo)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd5f64b86f0f834b — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_solaris.go:103 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0126605ec2ce4f0 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:208 
	f, err := os.Open(*inputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c571736887fd6f00 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:216 
	fasm, asmerr := os.Create(*outasm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3e0bfb7c1ea060c — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:230 
	fgo, goerr := os.Create(*outputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd06b8716cf95134 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:272 
	f, err := os.Create(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93a6973373f77e59 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:122 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f28f88ba7c8a2a3b — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:124 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88f8c819de356548 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:127 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2b8552ee93089e0 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:129 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfbfe046efdbd9cf — Filesystem access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:259 
		file, err := os.Open(filepath.Join("/usr/include", header))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ce9458868f3c461 — Filesystem access.
pkgs/go/[email protected]/unix/mksysnum.go:70 
	file, err := os.Open(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d28703e00a276f99 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:90 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccf8f44e188a689e — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:92 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7013329df11dcb4d — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:95 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a53f7ac6a465966d — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:97 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89027a40f3d5e9c3 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:710 
	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcaba38ef5127efd — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:894 
		err = os.WriteFile(*filename, data, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/text

go dependency
expand_more 31 low-confidence finding(s)
low env_fs dependency Excluded from app score #f2eaca2b3e6177ac — Filesystem access.
pkgs/go/[email protected]/cmd/gotext/main.go:328 
			if err := os.WriteFile("doc.go", b, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5319857c01b73d4c — Filesystem access.
pkgs/go/[email protected]/collate/tools/colcmp/colcmp.go:122 
		f, err := os.Create(*cpuprofile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f4bc9ef3b620dd3 — Filesystem access.
pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:160 
	dst, err := os.ReadFile(dstFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fba06cde56a7c803 — Filesystem access.
pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:162 
		if dst, err = os.ReadFile("../" + dstFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8761abda18e7ef7d — Filesystem access.
pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:166 
	src, err := os.ReadFile(srcFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ba461fdbc416590 — Filesystem access.
pkgs/go/[email protected]/encoding/internal/enctest/enctest.go:168 
		if src, err = os.ReadFile("../" + srcFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #97e01378defce516 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/go/[email protected]/encoding/korean/maketables.go:26 
	res, err := http.Get("http://encoding.spec.whatwg.org/index-euc-kr.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0fad1bb645c46f87 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/go/[email protected]/encoding/simplifiedchinese/maketables.go:31 
	res, err := http.Get("http://encoding.spec.whatwg.org/index-gb18030.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de3182db57b751bf — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/go/[email protected]/encoding/simplifiedchinese/maketables.go:57 
	res, err := http.Get("http://encoding.spec.whatwg.org/index-gbk.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ee8528e6ba1b6687 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/go/[email protected]/encoding/traditionalchinese/maketables.go:26 
	res, err := http.Get("http://encoding.spec.whatwg.org/index-big5.txt")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #74e1cb9bc8828f67 — Environment-variable access.
pkgs/go/[email protected]/gen.go:81 
		goroot := os.Getenv("GOROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a661fa07f3609115 — Filesystem access.
pkgs/go/[email protected]/gen.go:150 
	w, err := os.OpenFile(file, os.O_APPEND|os.O_WRONLY, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a7742a670b16bc7 — Filesystem access.
pkgs/go/[email protected]/gen.go:257 
		b, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e2f3fb3dc051004 — Filesystem access.
pkgs/go/[email protected]/gen.go:276 
		return os.WriteFile(file, b, 0666)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #693dcb4d554b4535 — Environment-variable access.
pkgs/go/[email protected]/internal/export/unicode/gen.go:45 
	if v := os.Getenv("UNICODE_VERSION"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f22e08293d4167cb — Filesystem access.
pkgs/go/[email protected]/internal/gen/code.go:53 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81fdaf4bdde893f4 — Filesystem access.
pkgs/go/[email protected]/internal/gen/code.go:73 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c9caae977b204b9 — Environment-variable access.
pkgs/go/[email protected]/internal/gen/gen.go:57 
	if v := os.Getenv(name); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41eb2bdce4eba759 — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:174 
		os.WriteFile(readme, []byte(readmeTxt), permissions)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c0db647b20bf3ed — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:207 
	if f, err := os.Open(file); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2517de7c298f136c — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:217 
	if err := os.WriteFile(file, b, permissions); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4520f4d1b55c20e5 — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:257 
	w, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #572caea566275344 — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:284 
		b, err := os.ReadFile(oldFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb1270cd3e46e51b — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:289 
		err = os.WriteFile(oldFile, b, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c01f19489910caf3 — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:305 
	w, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e6e54cfde21b6ee — Filesystem access.
pkgs/go/[email protected]/internal/gen/gen.go:338 
	src, err := os.ReadFile(inFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27c2735a34c3a3de — Filesystem access.
pkgs/go/[email protected]/internal/testtext/codesize.go:34 
	if err := os.WriteFile(filename, []byte(s), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e57e70adb8e647a — Filesystem access.
pkgs/go/[email protected]/message/pipeline/pipeline.go:231 
		b, err := ioutil.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e86888bde579560c — Filesystem access.
pkgs/go/[email protected]/message/pipeline/pipeline.go:362 
		if err := ioutil.WriteFile(file, data, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f28c6887a9c866f — Filesystem access.
pkgs/go/[email protected]/message/pipeline/rewrite.go:53 
				if w, err = os.Create(conf.Fset.File(f.Pos()).Name()); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d79d97b5db957470 — Filesystem access.
pkgs/go/[email protected]/unicode/cldr/decode.go:132 
	return os.Open(pl[i])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google.golang.org/grpc

go dependency
expand_more 49 low-confidence finding(s)
low env_fs dependency Excluded from app score #389582cab2dca1af — Filesystem access.
pkgs/go/[email protected]/authz/grpc_authz_server_interceptors.go:143 
	policyContents, err := os.ReadFile(i.policyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b0ba47f79fbb664e — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:961 
		f, err := os.Create(opts.cpuProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #043506c62644854f — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:979 
		f, err := os.Create(opts.memProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e584904e824f5c9b — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:992 
		f, err := os.Create(opts.benchmarkResultFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #957ec7857c249c0c — Filesystem access.
pkgs/go/[email protected]/benchmark/benchresult/main.go:44 
	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4e1888ab093e760a — Filesystem access.
pkgs/go/[email protected]/benchmark/benchresult/main.go:117 
	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fb35127c76a0d6c4 — Filesystem access.
pkgs/go/[email protected]/benchmark/client/main.go:104 
	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fd0905400ae35093 — Filesystem access.
pkgs/go/[email protected]/benchmark/client/main.go:117 
	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #88cbfcf2ff9fcf6b — Filesystem access.
pkgs/go/[email protected]/benchmark/server/main.go:66 
	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #23373164a7f04d3d — Filesystem access.
pkgs/go/[email protected]/benchmark/server/main.go:85 
	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #dd12851f056c6e16 — Filesystem access.
pkgs/go/[email protected]/benchmark/stats/curve.go:83 
	data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f4ddd77c6dcd3431 — Filesystem access.
pkgs/go/[email protected]/benchmark/stats/curve.go:104 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #131e3df0eefe915f — Filesystem access.
pkgs/go/[email protected]/credentials/jwt/file_reader.go:50 
	tokenBytes, err := os.ReadFile(r.tokenFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b984b2ed02105c9 — Filesystem access.
pkgs/go/[email protected]/credentials/oauth/oauth.go:76 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a966ce1c3f4115be — Filesystem access.
pkgs/go/[email protected]/credentials/oauth/oauth.go:195 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7203150aaabe2c3 — Filesystem access.
pkgs/go/[email protected]/credentials/tls.go:284 
	b, err := os.ReadFile(certFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76e8caf63370291c — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:164 
	certFileContents, err := os.ReadFile(w.opts.CertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13790516c81bf483 — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:169 
	keyFileContents, err := os.ReadFile(w.opts.KeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a43a2bccbeab11b — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:211 
	spiffeBundleMapContents, err := os.ReadFile(w.opts.SPIFFEBundleMapFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #565d15ab2609c5d7 — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:230 
	rootFileContents, err := os.ReadFile(w.opts.RootFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8f88f3622c599a4 — Filesystem access.
pkgs/go/[email protected]/experimental/credentials/tls.go:199 
	b, err := os.ReadFile(certFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1870a47e04a873c7 — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:65 
	logLevel := os.Getenv("GRPC_GO_LOG_SEVERITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9aeaaaac14aa4f05 — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:76 
	vLevel := os.Getenv("GRPC_GO_LOG_VERBOSITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6138740237966aa — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:81 
	jsonFormat := strings.EqualFold(os.Getenv("GRPC_GO_LOG_FORMATTER"), "json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6df1a812ecbf90c2 — Environment-variable access.
pkgs/go/[email protected]/internal/binarylog/binarylog.go:77 
	configStr := os.Getenv(envStr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a1b1816814f5a29 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:134 
		return !strings.EqualFold(os.Getenv(envVar), "false")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8876a74e2107917d — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:137 
	return strings.EqualFold(os.Getenv(envVar), "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #578dd3c5d2eae354 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:141 
	v, err := strconv.ParseUint(os.Getenv(envVar), 10, 64)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30c0fbd8c2869730 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/observability.go:34 
	ObservabilityConfig = os.Getenv(envObservabilityConfig)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f1fffa3480a43c1 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/observability.go:41 
	ObservabilityConfigFile = os.Getenv(envObservabilityConfigFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc6616ae5a4fb130 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:46 
	XDSBootstrapFileName = os.Getenv(XDSBootstrapFileNameEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6937e542f91abdac — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:52 
	XDSBootstrapFileContent = os.Getenv(XDSBootstrapFileContentEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e75d3faa56a748fb — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:55 
	C2PResolverTestOnlyTrafficDirectorURI = os.Getenv("GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72463534f6329f93 — Filesystem access.
pkgs/go/[email protected]/internal/googlecloud/manufacturer_linux.go:26 
	return os.ReadFile(linuxProductNameFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #080f47a8b351cb17 — Environment-variable access.
pkgs/go/[email protected]/internal/grpctest/tlogger.go:78 
	if vLevelEnv, found := os.LookupEnv("GRPC_GO_LOG_VERBOSITY_LEVEL"); found {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cdabcd58a6800b1 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:39 
	b, err := os.ReadFile(testdata.Path("x509/server_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e92117d9430ddd6 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:63 
	b, err := os.ReadFile(testdata.Path("x509/client_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ecb588301e3f955 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:89 
	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0b42ac21527de17 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:115 
	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42c4ef248b016086 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:143 
	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b97edbd6adcc3d23 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/bootstrap.go:158 
	data, err := os.ReadFile(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d05c24774109fe2d — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/bootstrap.go:162 
	if err := os.WriteFile(dst, data, os.ModePerm); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb44a38bafeaed1e — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds_bootstrap.go:42 
	if err := os.WriteFile(f.Name(), bootstrapContents, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bf924ad13848111 — Filesystem access.
pkgs/go/[email protected]/interop/client/client.go:222 
			b, err := os.ReadFile(*caFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91b85f3a2b8854c6 — Filesystem access.
pkgs/go/[email protected]/interop/test_utils.go:285 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6fb942f6f0e183b — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/catapult.go:378 
	streamStatsCatapultJSONFile, err := os.Create(streamStatsCatapultJSONFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b54db2c6790c41cf — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/local.go:29 
	snapshotFile, err := os.Open(snapshotFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae62f171428f7ab3 — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/remote.go:54 
	file, err := os.Create(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65433635671b091d — Environment-variable access.
pkgs/go/[email protected]/stats/opentelemetry/csm/pluginoption.go:168 
	if val, ok := os.LookupEnv(name); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gopkg.in/natefinch/lumberjack.v2

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #23b3a8eaaf268d5e — Filesystem access.
pkgs/go/[email protected]/chown_linux.go:12 
	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3187b8ec8f04c95 — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:235 
	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #335f1b4ef86889ce — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:280 
	file, err := os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #256844b73e32f518 — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:469 
	f, err := os.Open(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1886cf8d8790f80e — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:486 
	gzf, err := os.OpenFile(dst, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, fi.Mode())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

k8s.io/apimachinery

go dependency
expand_more 19 low-confidence finding(s)
low env_fs dependency Excluded from app score #b597c230ad6b21c3 — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/codec.go:73 
	if apiMediaType := os.Getenv("KUBE_TEST_API_TYPE"); len(apiMediaType) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4610bc40f6da0708 — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/codec.go:80 
	if storageMediaType := os.Getenv("KUBE_TEST_API_STORAGE_TYPE"); len(storageMediaType) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f00ec4098f14ec34 — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:268 
		if os.Getenv(updateEnvVar) == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #688f22c20382b4f0 — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:336 
	actualJSON, jsonErr := ioutil.ReadFile(filepath.Join(dir, jsonFilename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b0c4c1a86e7363e — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:338 
	actualYAML, yamlErr := ioutil.ReadFile(filepath.Join(dir, yamlFilename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbec96e6ff9cc126 — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:340 
	actualProto, protoErr := ioutil.ReadFile(filepath.Join(dir, protoFilename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52c17f1619c76e34 — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:362 
	if err := ioutil.WriteFile(filepath.Join(dir, makeName(gvk)+suffix+"."+extension), data, os.FileMode(0644)); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c05611f843b9f56b — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:480 
		if os.Getenv(updateEnvVar) == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bc633462d45ea2a — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/unstructured.go:55 
	if override := os.Getenv("TEST_RAND_SEED"); len(override) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f58b60594e41ddca — Environment-variable access.
pkgs/go/[email protected]/pkg/runtime/converter.go:78 
		mismatchDetection: parseBool(os.Getenv("KUBE_PATCH_CONVERSION_DETECTOR")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e076e0b1328809b — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:134 
	if s := os.Getenv("DISABLE_HTTP2"); len(s) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4765fccff0033357 — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:148 
	if s := os.Getenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS"); len(s) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b723aa68e171e0de — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:162 
	if s := os.Getenv("HTTP2_PING_TIMEOUT_SECONDS"); len(s) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b49dea401c93bde — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:400 
	noProxyEnv := os.Getenv("NO_PROXY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d710b452aec13fd — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:402 
		noProxyEnv = os.Getenv("no_proxy")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1308c05cc3849ac9 — Filesystem access.
pkgs/go/[email protected]/pkg/util/net/interface.go:97 
	file, err := os.Open(rf.name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91774428bded5102 — Filesystem access.
pkgs/go/[email protected]/pkg/util/strategicpatch/testing/openapi.go:45 
		spec, err := os.ReadFile(f.Path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a765d43e37607a27 — Filesystem access.
pkgs/go/[email protected]/pkg/util/strategicpatch/testing/openapi3.go:39 
		spec, err := os.ReadFile(f.Path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e28f1856773486cc — Filesystem access.
pkgs/go/[email protected]/pkg/util/strategicpatch/testing/openapi3.go:54 
		spec, err := os.ReadFile(f.Path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mosn.io/holmes

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #fa01fef49708c786 — Filesystem access.
pkgs/go/[email protected]/holmes.go:619 
		bfCpy, err = ioutil.ReadFile(binFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35b90e2ddfa37a68 — Filesystem access.
pkgs/go/[email protected]/reporters/http_reporter/http_reporter.go:57 
	data, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7c572425915114b — Filesystem access.
pkgs/go/[email protected]/util.go:58 
	v, err := ioutil.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #414fef707a73ffd7 — Filesystem access.
pkgs/go/[email protected]/util.go:209 
	f, err := os.OpenFile(filepath, defaultLoggerFlags, defaultLoggerPerm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d88b6f828d01281f — Filesystem access.
pkgs/go/[email protected]/util.go:214 
		f, err = os.OpenFile(filepath, defaultLoggerFlags, defaultLoggerPerm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • github.com/klauspost/compress prod — module zip exceeds byte cap
  • github.com/greatroar/blobloom prod — proxy 404
  • github.com/milvus-io/milvus/pkg/v3 prod — proxy 404
  • google.golang.org/api prod — module zip exceeds byte cap
  • github.com/huaweicloud/huaweicloud-sdk-go-v3 prod — module zip exceeds byte cap