Close Open Privacy Scan
App Privacy Score
High risk · 367 finding(s)
Based on: 7 first-party package(s) · 53/57 deps analyzed
Dependency score: 82 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz Confirmed data exfiltration in application code
External domains:
ahooks.js.organimations.devdate-fns.orgevilmartians.comgithub.comjson-schema.orglogin.salesforce.comorm.drizzle.teamreact.devreactjs.orgsonner.emilkowal.skitailwindcss.comtanstack.comtrpc.iotwitter.comunpkg.comwebplatform.github.iowww.w3.orgwww.w3ctech.com
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:414
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:442
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:471
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:501
- 1source
repo/apps/backend/src/auth.ts:42 - 2sink
repo/apps/backend/src/auth.ts:50
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:414
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:416
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:442
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:444
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:471
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:473
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:501
- 1source
repo/apps/frontend/hooks/useConnection.ts:377 - 2sink
repo/apps/frontend/hooks/useConnection.ts:503
</> First-Party Code
first-party (npm): apps/frontend
npm first-party fetch(url, {
...init,
headers,
credentials: "include",
}),User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.
Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
fetch(url, {
...init,
headers,
credentials: "include",
}),User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.
Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
fetch(url, {
...init,
headers,
credentials: "include",
}),User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.
Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
fetch(url, {
...init,
headers,
credentials: "include",
}),User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.
Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
fetch(url, {
...init,
headers,
credentials: "include",
}),A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
headers,A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
fetch(url, {
...init,
headers,
credentials: "include",
}),A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
headers,A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
fetch(url, {
...init,
headers,
credentials: "include",
}),A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
headers,A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
fetch(url, {
...init,
headers,
credentials: "include",
}),A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
headers,A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 10 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 9 locations
const serverUrl = process.env.NEXT_PUBLIC_APP_URL || process.env.APP_URL;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (npm): apps/backend
npm first-party logger.info(`✓ OIDC Provider configured: ${oidcConfig.providerId}`);PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 85 low-confidence finding(s)
low env_fs — Environment-variable access. 71 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 13 locations
import { createWriteStream, WriteStream } from "fs";Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
</> Dependencies
@better-fetch/fetch
npm dependencyexpand_more 1 low-confidence finding(s)
let response = await fetch(context.url, context);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
@hookform/resolvers
npm dependencyexpand_more 1 low-confidence finding(s)
if (schemaOptions?.context && process.env.NODE_ENV === 'development') {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
@modelcontextprotocol/sdk
npm dependencyexpand_more 38 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 22 locations
const response = await fetch(url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
writeFileSync(outputPath, fullContent, 'utf-8');Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 14 locations
@tailwindcss/postcss
npm dependencyexpand_more 11 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
let optimize = opts.optimize ?? process.env.NODE_ENV === 'production'Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
@tanstack/react-query
npm dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
@tanstack/react-query-devtools
npm dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
@trpc/client
npm dependencyexpand_more 1 low-confidence finding(s)
const requestSubscription = client
.request({
op,
transformer,
})Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
ahooks
npm dependencyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
class-variance-authority
npm dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
cross-spawn
npm dependencyexpand_more 2 low-confidence finding(s)
parsed.command = process.env.comspec || 'cmd.exe';Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
const fs = require('fs');Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
dotenv
npm dependencyexpand_more 18 low-confidence finding(s)
low env_fs — Environment-variable access. 16 locations
low env_fs — Filesystem access. 2 locations
drizzle-orm
npm dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations
execa
npm dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
express
npm dependencyexpand_more 1 low-confidence finding(s)
var env = process.env.NODE_ENV || 'development';Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
nanoid
npm dependencyexpand_more 1 low-confidence finding(s)
let json = readFileSync(join(import.meta.dirname, '..', 'package.json'))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
next-themes
npm dependencyexpand_more 4 low-confidence finding(s)
pg
npm dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
postcss
npm dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
low env_fs — Filesystem access. 2 locations
react
npm dependencyexpand_more 14 low-confidence finding(s)
low env_fs — Environment-variable access. 14 locations
react-dom
npm dependencyexpand_more 24 low-confidence finding(s)
low env_fs — Environment-variable access. 24 locations
react-hook-form
npm dependencyexpand_more 12 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
low env_fs — Filesystem access. 7 locations
const response = await fetch(String(action), {
method,
headers: {
...headers,
...(encType && encType !== 'multipart/form-data'
? { 'Content-Type': encType }
: {}),
},
body: shouldStringifySubmissionData ? formDataJson : formData,
});Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
react-syntax-highlighter
npm dependencyexpand_more 24 low-confidence finding(s)
low env_fs — Filesystem access. 24 locations
sonner
npm dependencyexpand_more 4 low-confidence finding(s)
spawn-rx
npm dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
swr
npm dependencyexpand_more 37 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 26 locations
low env_fs — Environment-variable access. 9 locations
low env_fs — Filesystem access. 2 locations
tailwindcss
npm dependencyexpand_more 16 low-confidence finding(s)
low env_fs — Environment-variable access. 9 locations
low env_fs — Filesystem access. 7 locations
zustand
npm dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
Skipped dependencies
Production
- @repo/trpc prod — registry 404
- @repo/zod-types prod — registry 404
- better-auth prod — dist-only: no readable source
- next prod — tarball exceeds byte cap