Close Open Privacy Scan

link https://github.com/dmlc/xgboost
bolt Snapshot: commit 2c131cd
science engine v1.21
schedule 2026-07-20T05:07:03.341781+00:00
update Scan engine updated since this result

help Not analyzed — coverage too low to judge

Too little of this repository was analyzed to judge — 10/22 dependencies were scanned. This is not a clean result; it means the scan could not run far enough to reach one.

App Privacy Score

— /100
Not analyzed — coverage too low

Coverage too low to score · 14 finding(s)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 14 low
First-party packages: 2
Dependency packages: 2
Ecosystem: java

swap_horiz Application data flows

Not enough of this repository was analyzed to look for application data flows. Absence of findings here is not evidence of a clean result.

</> First-Party Code

first-party (java): jvm-packages/xgboost4j

java first-party
expand_more 3 low-confidence finding(s)
low env_fs production #f1d5a0ee5f97c051 — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:63 
      String os = System.getProperty("os.name", "generic").toLowerCase(Locale.ENGLISH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f3a9ee7d397f3ff — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:101 
      String arch = System.getProperty("os.arch", "generic").toLowerCase(Locale.ENGLISH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #821ca3077e6bcb97 — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:135 
      String libraryPath = System.getProperty(getPropertyNameForLibrary(libName));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (java): jvm-packages/xgboost4j-example

java first-party
expand_more 2 low-confidence finding(s)
low env_fs test-only Excluded from app score #591c8c1d5c5341b2 — Filesystem access.
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:48 
    FileInputStream in = new FileInputStream(f);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #df31cbf7e57fa6b9 — Filesystem access.
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:91 
    FileInputStream in = new FileInputStream(f);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

com.esotericsoftware:kryo

java dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #c9673140dd959914 — Environment-variable access.
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:38 
	public static final boolean isAndroid = "Dalvik".equals(System.getProperty("java.vm.name"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5665ad4f4fd8ae8c — Environment-variable access.
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:44 
		if ("false".equals(System.getProperty("kryo.unsafe"))) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

commons-logging:commons-logging

java dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #16116c04a3c2649a — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1016 
        return AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty(key, def));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8132b24094d5cae — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1193 
            logDiagnostic("[ENV] Extension directories (java.ext.dir): " + System.getProperty("java.ext.dir"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c39549eb22dba926 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1194 
            logDiagnostic("[ENV] Application classpath (java.class.path): " + System.getProperty("java.class.path"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e40fd77f32eb947 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:88 
            name = System.getProperty("org.apache.commons.logging.log");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5b844c76f67ad8c — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:90 
                name = System.getProperty("org.apache.commons.logging.Log");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bf9a712a4b4ed01 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/impl/LogFactoryImpl.java:211 
        return AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty(key, def));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a3049eb742aa8a2 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/impl/SimpleLog.java:216 
            prop = System.getProperty(name);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • scipy prod — sdist exceeds byte cap
  • nvidia-nccl-cu12 prod — no sdist (wheels only)
  • matplotlib prod — sdist exceeds byte cap
  • pyspark prod — sdist exceeds byte cap
  • org.scala-lang:scala-compiler prod — no sources jar (404)
  • org.scala-lang:scala-library prod — no sources jar (404)
  • org.scala-lang.modules:scala-collection-compat_${scala.binary.version} prod — no sources jar (404)
  • org.apache.hadoop:hadoop-common prod — no sources jar (404)
  • ml.dmlc:xgboost4j-spark_2.12 prod — no sources jar (404)
  • ml.dmlc:xgboost4j-flink_2.12 prod — no sources jar (404)
  • ml.dmlc:xgboost4j_2.12 prod — no sources jar (404)
  • org.apache.flink:flink-clients prod — no sources jar (404)