Close Open Privacy Scan
App Privacy Score
Low risk · 915 finding(s)
Based on: 18 first-party package(s) · 122/130 deps analyzed
Dependency score: 82 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz Application data flows
External domains:
30days.streamlit.appa-za.tile.openstreetmap.orgaccount.mapbox.comaccounts.google.comalembic.sqlalchemy.orgallthatsinteresting.comaltair-viz.github.ioapi.mapbox.comapps.mapbox.comarrow.apache.orgauth0.comaws.amazon.comb.tile.openstreetmap.orgbasemaps.cartocdn.combaseweb.designbit.lybitbucket.orgbl.ocks.orgbugs.python.orgbugs.webkit.orgcarto.comcartodb-basemaps-c.global.ssl.fastly.netcdn.jsdelivr.netcdn.plot.lycdnjs.cloudflare.comchart-studio.plotly.comchatgpt.comcheckip.amazonaws.comchromewebstore.google.comclick.palletsprojects.comcloud.google.comcode.activestate.comcode.google.comcollaboration.cmc.ec.gc.cacolor2k.comconsent.yahoo.comcran.r-project.orgcreativecommons.orgcx-oracle.readthedocs.iod3js.orgdata-apis.orgdata.iana.orgdata.jsdelivr.comdata.streamlit.iodata.un.orgdatabase.windows.netdatapackage.orgdatatracker.ietf.orgdate-fns.orgdeck.gldeckgl.readthedocs.iodemourl.libpathdeno.landdev.mysql.comdeveloper.android.comdeveloper.mozilla.orgdevelopers.google.comdiscuss.streamlit.iodoc-area-chart-steamgraph.streamlit.appdoc-area-chart.streamlit.appdoc-area-chart1.streamlit.appdoc-area-chart2.streamlit.appdoc-areachart-column.streamlit.appdoc-audio-column.streamlit.appdoc-audio-input-high-rate.streamlit.appdoc-audio-input.streamlit.appdoc-audio-purr.streamlit.appdoc-audio.streamlit.appdoc-badge.streamlit.appdoc-bar-chart-horizontal.streamlit.appdoc-bar-chart-unstacked.streamlit.appdoc-bar-chart.streamlit.appdoc-bar-chart1.streamlit.appdoc-bar-chart2.streamlit.appdoc-barchart-column.streamlit.appdoc-buton.streamlit.appdoc-button-icons.streamlit.appdoc-button-shortcuts.streamlit.appdoc-camera-input.streamlit.appdoc-chart-events-plotly-selection-state.streamlit.appdoc-chart-events-plotly-state.streamlit.appdoc-chart-events-vega-lite-state.streamlit.appdoc-chat-input-audio.streamlit.appdoc-chat-input-file-uploader.streamlit.appdoc-chat-input-inline.streamlit.appdoc-chat-input-session-state.streamlit.appdoc-chat-input.streamlit.appdoc-chat-message-user.streamlit.appdoc-chat-message-user1.streamlit.appdoc-checkbox-column.streamlit.appdoc-checkbox.streamlit.appdoc-code-ascii.streamlit.appdoc-code.streamlit.appdoc-color-picker.streamlit.appdoc-column.streamlit.appdoc-columns-borders.streamlit.appdoc-columns-bottom-widgets.streamlit.appdoc-columns-vertical-alignment.streamlit.appdoc-columns1.streamlit.appdoc-columns2.streamlit.appdoc-components-cleanup-function.streamlit.appdoc-components-custom-anchors.streamlit.appdoc-components-interactive-svg.streamlit.appdoc-components-markdown-links.streamlit.appdoc-components-tailwind-button.streamlit.appdoc-components-text-input.streamlit.appdoc-container1.streamlit.appdoc-container2.streamlit.appdoc-container3.streamlit.appdoc-container4.streamlit.appdoc-container5.streamlit.appdoc-data-editor-config.streamlit.appdoc-data-editor.streamlit.appdoc-data-editor1.streamlit.appdoc-dataframe-config-index.streamlit.appdoc-dataframe-config.streamlit.appdoc-dataframe-events-selection-state.streamlit.appdoc-dataframe-programmatic-selections.streamlit.appdoc-dataframe.streamlit.appdoc-dataframe1.streamlit.appdoc-date-column.streamlit.appdoc-date-input-empty.streamlit.appdoc-date-input.streamlit.appdoc-date-input1.streamlit.appdoc-datetime-column.streamlit.appdoc-datetime-input-empty.streamlit.appdoc-datetime-input.streamlit.appdoc-download-button-csv.streamlit.appdoc-download-button-deferred.streamlit.appdoc-download-button-file.streamlit.appdoc-download-button-text.streamlit.appdoc-empty-placeholder.streamlit.appdoc-empty.streamlit.appdoc-expander-callback.streamlit.appdoc-expander-conditional-outside.streamlit.appdoc-expander-lazy-load.streamlit.appdoc-expander.streamlit.appdoc-feedback-stars.streamlit.appdoc-feedback-thumbs.streamlit.appdoc-file-uploader-directory.streamlit.appdoc-file-uploader.streamlit.appdoc-form1.streamlit.appdoc-form2.streamlit.appdoc-fragment-balloons.streamlit.appdoc-fragment-rerun.streamlit.appdoc-fragment.streamlit.appdoc-graphviz-chart.streamlit.appdoc-header.streamlit.appdoc-html.streamlit.appdoc-image-column.streamlit.appdoc-image.streamlit.appdoc-json-column.streamlit.appdoc-json.streamlit.appdoc-line-chart.streamlit.appdoc-line-chart1.streamlit.appdoc-line-chart2.streamlit.appdoc-linechart-column.streamlit.appdoc-link-button.streamlit.appdoc-link-column.streamlit.appdoc-list-column.streamlit.appdoc-logo.streamlit.appdoc-map-color.streamlit.appdoc-map.streamlit.appdoc-markdown-column.streamlit.appdoc-markdown.streamlit.appdoc-menu-button.streamlit.appdoc-mermaid-chart.streamlit.appdoc-metric-example1.streamlit.appdoc-metric-example2.streamlit.appdoc-metric-example3.streamlit.appdoc-metric-example4.streamlit.appdoc-metric-example5.streamlit.appdoc-metric-example6.streamlit.appdoc-modal-dialog.streamlit.appdoc-multiselect-accept-new-options.streamlit.appdoc-multiselect-column-1.streamlit.appdoc-multiselect-column-2.streamlit.appdoc-multiselect.streamlit.appdoc-navigation-example-1.streamlit.appdoc-navigation-example-2.streamlit.appdoc-navigation-multipage-widgets.streamlit.appdoc-navigation-top.streamlit.appdoc-number-column.streamlit.appdoc-number-input-empty.streamlit.appdoc-number-input.streamlit.appdoc-page-link-query-params.streamlit.appdoc-page-link.streamlit.appdoc-pagination-dataframe.streamlit.appdoc-pagination.streamlit.appdoc-pills-multi.streamlit.appdoc-pills-single.streamlit.appdoc-plotly-chart-config.streamlit.appdoc-plotly-chart.streamlit.appdoc-popover-callback.streamlit.appdoc-popover-conditional-outside.streamlit.appdoc-popover-lazy-load.streamlit.appdoc-popover.streamlit.appdoc-popover2.streamlit.appdoc-progress-column.streamlit.appdoc-pydeck-chart.streamlit.appdoc-pydeck-event-state-selections.streamlit.appdoc-pyplot.streamlit.appdoc-radio-empty.streamlit.appdoc-radio.streamlit.appdoc-scatter-chart.streamlit.appdoc-scatter-chart1.streamlit.appdoc-scatter-chart2.streamlit.appdoc-segmented-control-multi.streamlit.appdoc-segmented-control-single.streamlit.appdoc-select-slider.streamlit.appdoc-selectbox-accept-new-options.streamlit.appdoc-selectbox-column.streamlit.appdoc-selectbox-empty.streamlit.appdoc-selectbox.streamlit.appdoc-skeleton-context.streamlit.appdoc-skeleton-standalone.streamlit.appdoc-slider.streamlit.appdoc-space-horizontal.streamlit.appdoc-space-vertical.streamlit.appdoc-spinner.streamlit.appdoc-status-exception.streamlit.appdoc-status-progress.streamlit.appdoc-status-toast.streamlit.appdoc-status-toast1.streamlit.appdoc-status-toast2.streamlit.appdoc-status-update.streamlit.appdoc-status.streamlit.appdoc-string.streamlit.appdoc-string1.streamlit.appdoc-string2.streamlit.appdoc-subheader.streamlit.appdoc-switch-page-query-params.streamlit.appdoc-switch-page.streamlit.appdoc-table-auto-header.streamlit.appdoc-table-confusion.streamlit.appdoc-table-hide-header-and-index.streamlit.appdoc-table-horizontal-border.streamlit.appdoc-tabs-callback.streamlit.appdoc-tabs-conditional-outside.streamlit.appdoc-tabs-lazy-load.streamlit.appdoc-tabs1.streamlit.appdoc-tabs2.streamlit.appdoc-tabs3.streamlit.appdoc-text-area.streamlit.appdoc-text-column.streamlit.appdoc-text-input.streamlit.appdoc-text.streamlit.appdoc-time-column.streamlit.appdoc-time-input-empty.streamlit.appdoc-time-input.streamlit.appdoc-title.streamlit.appdoc-toggle.streamlit.appdoc-vega-lite-chart.streamlit.appdoc-video-column.streamlit.appdoc-video-subtitle-inputs.streamlit.appdoc-video-subtitles.streamlit.appdoc-video.streamlit.appdoc-write-stream-data.streamlit.appdoc-write1.streamlit.appdoc-write2.streamlit.appdoc-write3.streamlit.appdocs.astral.shdocs.bodo.aidocs.mapbox.comdocs.microsoft.comdocs.pola.rsdocs.pytest.orgdocs.python.orgdocs.scipy.orgdocs.snowflake.comdocs.sqlalchemy.orgdocs.streamlit.iodownload.oracle.comduckdb.orgen.m.wikipedia.orgen.wikipedia.orgen.wikiversity.orgesm.shevents.mapbox.cnevents.mapbox.comexslt.orgextras.streamlit.appfc.yahoo.comfilesystem-spec.readthedocs.iofinance.yahoo.comfonts.google.comfonts.googleapis.comfonts.gstatic.comfonts.openmaptiles.orgforum.omz-software.comgeoserveis.icgc.catget.webgl.orggist.github.comgit-scm.comgithub.bloggithub.comgithub.github.comgoogle.comguce.yahoo.comhtml.spec.whatwg.orghttpbin.orgi.imgur.comi.redd.itissues.streamlit.appjse.amstat.orgjson-schema.orgkatex.orgkroki.iokubernetes.iolearn.microsoft.comlegacy.python.orglh3.googleusercontent.comlogin.microsoftonline.commagicstack.github.iomapbox.commaplibre.orgmarkets.businessinsider.commatplotlib.orgmdn.github.iomermaid.js.orgmomentjs.commsdn.microsoft.comnarwhals-dev.github.ionot.a.real.urlnpms.ionumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgopenid.netopensource.orgopenstreetmap.orgoracle.github.iopackaging.python.orgpandas.pydata.orgparquet.apache.orgpeps.python.orgpicsum.photosplot.lyplotly.compresbrey.mit.edupreview.redd.itprotobuf.devpymysql.readthedocs.iopyperclip.readthedocs.iopypi.orgpython-oracledb.readthedocs.ioquery1.finance.yahoo.comquery2.finance.yahoo.comraw.githubusercontent.comreact-window-8cygyvomv-brian-vaughns-projects.vercel.appreact-window-9gegorjnr-brian-vaughns-projects.vercel.appreact-window-btpcws98u-brian-vaughns-projects.vercel.appreact-window.vercel.appreact.devreactjs.orgrefspecs.linuxfoundation.orgrequests.readthedocs.iorico.codesroadmap.streamlit.apps3-us-west-2.amazonaws.comsass-lang.comschema.orgserver.arcgisonline.comsethmlarson.devshare-demo.streamlit.ioshare-head.streamlit.ioshare-staging.streamlit.ioshare.streamlit.iosites.google.comsome-prefix.comsourceforge.netspecifications.freedesktop.orgspecs.frictionlessdata.iosqlalche.mesqlite.orgstackoverflow.comstamen.comstatic.streamlit.iostorage.googleapis.comstreamlit-demo-data.s3-us-west-2.amazonaws.comstreamlit.iosupport.sas.comtc39.estc39.github.iotechnet.microsoft.comtechspot.zzzeek.orgtestnb.readthedocs.iotile.openstreetmap.orgtilemaps.icgc.cattiles-a.basemaps.cartocdn.comtiles-b.basemaps.cartocdn.comtiles-c.basemaps.cartocdn.comtiles-d.basemaps.cartocdn.comtiles.basemaps.cartocdn.comtiles.stadiamaps.comtools.ietf.orgtyping.readthedocs.iounpkg.comupload.wikimedia.orguse.typekit.netvega.github.ioweb.archive.orgwebsockets.readthedocs.iowerkzeug.palletsprojects.comwiki.openstreetmap.orgwww.apache.orgwww.esri.comwww.extremelycoolapp.comwww.freetds.orgwww.gevent.orgwww.glideapps.comwww.google.comwww.gossamer-threads.comwww.iana.orgwww.ietf.orgwww.mapbox.comwww.npmjs.comwww.openstreetmap.orgwww.opm.govwww.oracle.comwww.postgresql.orgwww.psycopg.orgwww.python.orgwww.rfc-editor.orgwww.sitemaps.orgwww.sqlite.orgwww.stata.comwww.statsmodels.orgwww.streamlit.iowww.typescriptlang.orgwww.w3.orgwww.w3schools.comwww.webmproject.orgwww.youtube.comwww.zetetic.netxarray.pydata.orgxlrd.readthedocs.ioyoutu.be
- 1source
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:60 - 2sink
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:63
- 1source
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:74 - 2sink
pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:77
</> First-Party Code
first-party (python)
python first-partyexpand_more 553 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 7 locations
low env_fs — Environment-variable access. 476 locations
low env_fs — Filesystem access. 55 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 10 locations
low pii_flow — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration. Non-production path — not application runtime. 3 locations
low pii_flow — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent. Non-production path — not application runtime. 2 locations
first-party (python): lib
python first-partyexpand_more 56 low-confidence finding(s)
low env_fs — Environment-variable access. 19 locations
low env_fs — Filesystem access. 32 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations
response_json = requests.get(
"https://data.streamlit.io/metrics.json", timeout=2
).json()Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
</> Dependencies
pyarrow
python dependency headers=headers,A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
headers=headers,A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 21 low-confidence finding(s)
low env_fs — Filesystem access. 9 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations
low env_fs — Environment-variable access. 8 locations
@streamlit/component-v2-lib
python dependencyexpand_more 5 low-confidence finding(s)
img_bytes = urllib.request.urlopen(img_url).read()Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs — Filesystem access. 4 locations
SQLAlchemy
python dependencyexpand_more 29 low-confidence finding(s)
self._pool.put(record, False)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs — Filesystem access. 19 locations
low env_fs — Environment-variable access. 9 locations
altair
python dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
low env_fs — Filesystem access. 2 locations
anyio
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
click
python dependencyexpand_more 31 low-confidence finding(s)
low env_fs — Filesystem access. 8 locations
low env_fs — Environment-variable access. 23 locations
gitpython
python dependencyexpand_more 55 low-confidence finding(s)
low env_fs — Filesystem access. 32 locations
low env_fs — Environment-variable access. 23 locations
httptools
python dependencyexpand_more 1 low-confidence finding(s)
with open(str(ROOT / 'httptools' / '_version.py')) as f:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
katex
python dependencyexpand_more 1 low-confidence finding(s)
with open(file_name, 'rb') as f:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
orjson
python dependencyexpand_more 40 low-confidence finding(s)
low env_fs — Filesystem access. 40 locations
packaging
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
pandas
python dependencyexpand_more 29 low-confidence finding(s)
low env_fs — Filesystem access. 12 locations
low env_fs — Environment-variable access. 16 locations
return urllib.request.urlopen(*args, **kwargs) # noqa: TID251Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
protobuf
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
with open(os.path.join('google', 'protobuf', '__init__.py')) as version_file:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pydeck
python dependencyexpand_more 13 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
low env_fs — Filesystem access. 7 locations
python-multipart
python dependencyexpand_more 1 low-confidence finding(s)
tmp_file = open(path, "w+b")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
requests
python dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 8 locations
starlette
python dependencyexpand_more 2 low-confidence finding(s)
def __init__(self, environ: MutableMapping[str, str] = os.environ):Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
with open(file_name, encoding=encoding) as input_file:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
toml
python dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
typing-extensions
python dependencyexpand_more 7 low-confidence finding(s)
low env_fs — Filesystem access. 7 locations
uvicorn
python dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 2 locations
vega-datasets
python dependencyexpand_more 3 low-confidence finding(s)
with io.open(path, encoding=encoding) as fp:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
websockets
python dependencyexpand_more 24 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low env_fs — Environment-variable access. 22 locations
yfinance
python dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
_DISABLE = os.environ.get("YF_DISABLE_CURL_CFFI", "").lower() in ("1", "true", "yes")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 6 locations
Skipped dependencies
Production
- @streamlit/connection prod — registry 404
- @streamlit/lib prod — registry 404
- @streamlit/protobuf prod — registry 404
- @streamlit/utils prod — registry 404
- @types/react-helmet-async prod — no javascript source
- typed-signals prod — dist-only: no readable source
- react-select prod — dist-only: no readable source
- pillow prod — sdist exceeds byte cap