Close Open Privacy Scan
App Privacy Score
82
/100
Low privacy risk
Low risk · 63 finding(s)
Based on: 1 first-party package(s) · 0/0 deps analyzed
Dependency score: 100 (Low risk)
bar_chart Score Breakdown
egress
−15
env_fs
−3
list Scan Summary
0 high
0 medium
63 low
First-party packages:
1
Dependency packages:
0
Ecosystem:
npm
swap_horiz External domains
chromeuxreport.googleapis.comffmpeg.orggithub.complay.googleapis.compolicies.google.comregistry.npmjs.orgurlpattern.spec.whatwg.orgwww.chromium.orgwww.ffmpeg.org
</> First-Party Code
first-party (npm)
npm first-partyexpand_more 63 low-confidence finding(s)
low env_fs — Environment-variable access. 15 locations
low env_fs — Filesystem access. 44 locations
low
pii_flow
test-only
Excluded from app score
#3115ef80ce798e5b
—
PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.
repo/scripts/count_tokens.ts:44
· flow /tmp/closeopen-fksfbyxd/repo/scripts/count_tokens.ts:12 → /tmp/closeopen-fksfbyxd/repo/scripts/count_tokens.ts:44
console.log(`Tokens: ${response.totalTokens}`);PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.