Close Open Privacy Scan

bolt Snapshot: commit 4e52b5f
science engine v1.23
schedule 2026-07-26T17:06:51.071177+00:00

verified_user Possible application data leak

Potential data exfiltration identified in application code.

App Privacy Score

67 /100
Medium privacy risk — possible application leak

Medium risk · 400 finding(s)

Based on: 1 first-party package(s) · 0/0 deps analyzed

Dependency score: 100 (Low risk)

bar_chart Score Breakdown

egress −15
pii_flow −15
env_fs −3

list Scan Summary

0 high 1 medium 399 low
First-party packages: 1
Dependency packages: 0
Ecosystem: python

swap_horiz Potential data exfiltration in application code

External domains: api.github.comarxiv.orgawsdocs-neuron.readthedocs-hosted.combfl.aiblackforestlabs.aiblog.fal.aicivitai.comd2drjpuinn46lb.cloudfront.netdiscuss.pytorch.orgdocs.pytorch.orgen.wikipedia.orgencrypted-tbn0.gstatic.comfacebookresearch.github.iogithub.comhf.cohuggingface.coi2vgen-xl.github.ioimages.cocodataset.orgimages.pexels.comlaion.ailh3.googleusercontent.comlibrosa.orgmarigoldcomputervision.github.iomarigoldmonodepth.github.iomedia.githubusercontent.como7ywnmrahorts457.us-east-1.aws.endpoints.huggingface.cloudpillow.readthedocs.ioptccx55jz97f9zgo.us-east-1.aws.endpoints.huggingface.cloudpypi.orgpytorch.orgq1bj3bpq6kzilnsu.us-east-1.aws.endpoints.huggingface.cloudqc6479g0aac6qwy9.us-east-1.aws.endpoints.huggingface.cloudraw.githubusercontent.comremote-text-encoder-flux-2.huggingface.cotest.pypi.orgtestpypi.python.orguser-images.githubusercontent.comwhhx50ex1aryqvw6.us-east-1.aws.endpoints.huggingface.cloudwww.aiml.informatik.tu-darmstadt.dewww.nvidia.comx2dmsqunjd6k9prw.us-east-1.aws.endpoints.huggingface.cloudxjqqhmyn62rog84g.us-east-1.aws.endpoints.huggingface.cloud

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcerepo/utils/label_issues.py:91
  2. 2sinkrepo/utils/label_issues.py:117

</> First-Party Code

first-party (python)

python first-party
medium pii_flow production #708259d1b5ea1187 PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
repo/utils/label_issues.py:117 · flow /tmp/closeopen-6161nish/repo/utils/label_issues.py:91 → /tmp/closeopen-6161nish/repo/utils/label_issues.py:117
        print(json.dumps(labels))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 399 low-confidence finding(s)
low env_fs Environment-variable access. 159 locations
low env_fs Filesystem access. 208 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 27 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 5 locations