Close Open Privacy Scan
App Privacy Score
Low risk · 229 finding(s)
Based on: 7 first-party package(s) · 111/130 deps analyzed
Dependency score: 57 (Medium risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
687fb701029421ae5549d998--8000.hf.jobsabseil.ioaclanthology.orgagentskills.ioaggregate.ee.engr.uky.eduai.google.devaistudio.google.comanimations.devapi-inference.huggingface.coapi.anthropic.comapi.cerebras.aiapi.cohere.comapi.deepinfra.comapi.deepseek.comapi.endpoints.huggingface.cloudapi.featherless.aiapi.fireworks.aiapi.github.comapi.groq.comapi.mistral.aiapi.moonshot.aiapi.moonshot.cnapi.novita.aiapi.nuget.orgapi.openai.comapi.openai.com.attacker.comapi.publicai.coapi.replicate.comapi.scaleway.aiapi.slack.comapi.telegram.orgapi.together.xyzapi.wavespeed.aiapi.z.aiapp.neptune.aiarrow.apache.orgarstechnica.comarxiv.orgauai.orgawsdocs-neuron.readthedocs-hosted.combase-ui.combfl.aibitbucket.orgblackforestlabs.aiblog.fal.aiblog.famzah.netbootlin.combugreports.qt.iobugs.python.orgbugs.winehq.orgbugzilla.gnome.orgcdn-datasets.huggingface.cocdn-media.huggingface.cocdn.britannica.comcdn.mathjax.orgcdnjs.cloudflare.comcens.ioc.eecheck-host.netcivitai.comclaude.aiclear.mlclick.palletsprojects.comclip-cn-beijing.oss-cn-beijing.aliyuncs.comcloudflare-dns.comcode.activestate.comcodeload.github.comcolab.research.google.comcollaboration.cmc.ec.gc.cacoqui.aicore.telegram.orgcran.r-project.orgcrates.iocs-people.bu.educve.mitre.orgcyclopts.readthedocs.iod2drjpuinn46lb.cloudfront.netdagshub.comdashscope-intl.aliyuncs.comdashscope.aliyuncs.comdata-apis.orgdatasets-server.huggingface.codatatracker.ietf.orgdev-discuss.pytorch.orgdeveloper.android.comdeveloper.download.nvidia.comdeveloper.mozilla.orgdeveloper.nvidia.comdevelopers.google.comdigitalassets.lib.berkeley.edudiscord.comdiscordpy.readthedocs.iodiscuss.huggingface.codiscuss.python.orgdiscuss.pytorch.orgdl.acm.orgdmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdocs.bodo.aidocs.github.comdocs.h5py.orgdocs.microsoft.comdocs.neptune.aidocs.nvidia.comdocs.pydantic.devdocs.pytest.orgdocs.python.orgdocs.pytorch.orgdocs.ray.iodocs.rsdocs.scipy.orgdocs.sqlalchemy.orgdocs.swanlab.cndocs.unsloth.aidocs.wandb.aidoi.orgdownload.pytorch.orgdvc.orgen.ig.maen.wikipedia.orgen.wikiversity.orgencrypted-tbn0.gstatic.comendpoints.huggingface.coerrors.pydantic.devessentia.upf.eduevents.telemetry.data.nvidia.comexam_ple.comexslt.orgfacebookresearch.github.iofal.runfarm4.staticflickr.comfiles.worldwildlife.orgfilesystem-spec.readthedocs.ioflax.readthedocs.ioflyte.orgfoo.comformulae.brew.shgcc.gnu.orggenerativelanguage.googleapis.comgiou.stanford.edugist.github.comgit-scm.comgit.kernel.orggithub.comgitlab.comgitlab.freedesktop.orggoo.glgraphics.stanford.edugroups.google.comguillaumejaume.github.iohf.cohips.hearstapps.comhost.comhtml.spec.whatwg.orghttpbin.orghub-ci.huggingface.cohub.docker.comhub.my-company.comhuggingface.cohyper.rshypothesis.readthedocs.ioi.postimg.cci2vgen-xl.github.ioicml.ccifconfig.meimageio.readthedocs.ioimages.cocodataset.orgimages.nvidia.comimages.pexels.cominference.api.nscale.comipython.orgipywidgets.readthedocs.ioj3-fortran.orgjax.readthedocs.iojoschu.netjson-schema.orgjsonlines.orgjzgu0buei5.us-east-1.aws.endpoints.huggingface.cloudkeras.iokexue.fmlaion.ailh3.googleusercontent.comlibrosa.orglibsdl.orglinuxdevcenter.comlists.sourceforge.netmail.python.orgmarc.najork.orgmarigoldcomputervision.github.iomarigoldmonodepth.github.iomathworld.wolfram.commatplotlib.orgmcp.context7.commcp.exa.aimedia.githubusercontent.commesonbuild.commetacpan.orgmistralai.github.iomy-text-to-image.region.vendor.endpoints.huggingface.cloudmy-vllm-server.commypy.readthedocs.ionats.iondjson.orgnew-url.comnew.webhook.sitenicolas.limare.netnineplanets.orgnlp.stanford.edunodejs.orgnpmjs.comnumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnumpydoc.readthedocs.ioo7ywnmrahorts457.us-east-1.aws.endpoints.huggingface.cloudoai.endpoints.kepler.ai.cloud.ovh.netomoindrot.github.ioonnxruntime.aiopenclaw.aiopencode.aiopenreview.netopenrouter.aioptuna.readthedocs.iopackages.msys2.orgpackaging.python.orgpaddle-model-ecology.bj.bcebos.compandas.pydata.orgpapers.nips.ccparquet.apache.orgpbs.twimg.compenghao-bdsc.github.iopeople.eecs.berkeley.edupeps.python.orgpersonal.math.ubc.capillow.readthedocs.ioplatform.claude.complatform.kimi.aiplatform.openai.compresbrey.mit.eduproceedings.neurips.ccprotobuf.devptccx55jz97f9zgo.us-east-1.aws.endpoints.huggingface.cloudpublic.ukp.informatik.tu-darmstadt.depurl.oclc.orgpydantic-docs.helpmanual.iopygments.orgpyinstaller.readthedocs.iopymupdf.readthedocs.iopyperclip.readthedocs.iopypi.orgpython-devtools.helpmanual.iopytorch.orgpyyaml.orgq1bj3bpq6kzilnsu.us-east-1.aws.endpoints.huggingface.cloudqc6479g0aac6qwy9.us-east-1.aws.endpoints.huggingface.cloudqianwen-res.oss-cn-beijing.aliyuncs.comqueue.fal.runqwenlm.github.ioraw.githubusercontent.comreact-resizable-panels-au2wmqbbr-brian-vaughns-projects.vercel.appreact-resizable-panels-ca7gk2gh5-brian-vaughns-projects.vercel.appreact-resizable-panels.vercel.appreact-virtualized-auto-sizer.vercel.appreact.devreactjs.orgrefspecs.linuxfoundation.orgremote-text-encoder-flux-2.huggingface.corepo.amd.comrequests.readthedocs.ioresources.nvidia.comrich.readthedocs.iorocm.docs.amd.comrouter.huggingface.corrc.cvc.uab.ess3.amazonaws.comsafetensors-convert.hf.spacesbert.netschemas.microsoft.comschemas.openxmlformats.orgschemas.zwobble.orgscikit-image.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgserverfault.comsonner.emilkowal.skisourceware.orgspecs.frictionlessdata.iospherelab.aistackoverflow.comstatus.huggingface.costorage.googleapis.comsuno-ai.notion.sitesupport.sas.comswanlab.cntailwindcss.comtest.pypi.orgtestpypi.python.orgthumbs.dreamstime.comtldp.orgtqdm.github.iotriton-lang.orgtruststore.readthedocs.iotvm.apache.orgtwitter.comtyper.tiangolo.comtyping.python.orgui.shadcn.comunsloth.aiupload.wikimedia.orguser-images.githubusercontent.comviews.scientific-python.orgweave-docs.wandb.aiweb.archive.orgwebhook.sitewhhx50ex1aryqvw6.us-east-1.aws.endpoints.huggingface.cloudwixtoolset.orgwrapdb.mesonbuild.comwww.aclweb.orgwww.aiml.informatik.tu-darmstadt.dewww.ams.orgwww.artifex.comwww.arxiv.orgwww.brynosaurus.comwww.comet.comwww.cs.cmu.eduwww.deepmind.comwww.deepspeed.aiwww.desmos.comwww.dvc.orgwww.ecma-international.orgwww.example.珠宝www.gnu.orgwww.google.comwww.ietf.orgwww.ilankelman.orgwww.intel.comwww.json.orgwww.kxan.comwww.math.hmc.eduwww.mathjax.orgwww.mathworks.comwww.microsoft.comwww.mlflow.orgwww.nativewind.devwww.nature.comwww.nvidia.comwww.oasis-open.orgwww.openblas.netwww.opm.govwww.oreilly.comwww.paddleocr.aiwww.python-httpx.orgwww.python.orgwww.researchgate.netwww.sbert.netwww.scipy.orgwww.scivision.devwww.stata.comwww.statsmodels.orgwww.stixfonts.orgwww.systutorials.comwww.tensorflow.orgwww.textualize.iowww.w3.orgwww.wandb.comwww.xudongz.comwww.xyz.edux.comx2dmsqunjd6k9prw.us-east-1.aws.endpoints.huggingface.cloudxarray.pydata.orgxjqqhmyn62rog84g.us-east-1.aws.endpoints.huggingface.cloudxlrd.readthedocs.ioyou-seta.hf.space
</> First-Party Code
first-party (rust): studio/src-tauri
rust first-partyexpand_more 63 low-confidence finding(s)
low env_fs — Filesystem access. 49 locations
low env_fs — Environment-variable access. 11 locations
let response = match client.get(DESKTOP_UPDATER_CHANNEL_URL).send().await {Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 2 locations
</> Dependencies
base64
rust dependencyexpand_more 1 low-confidence finding(s)
Some(f) => Box::new(File::open(f).unwrap()),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
dirs
rust dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
reqwest
rust dependencyexpand_more 42 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 4 locations
low env_fs — Filesystem access. 3 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 33 locations
low env_fs — Environment-variable access. 2 locations
serde
rust dependencyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
fs::write(out_dir.join("private.rs"), module).unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
serde_json
rust dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
simplelog
rust dependencyexpand_more 31 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 19 locations
low env_fs — Filesystem access. 12 locations
tauri
rust dependencyexpand_more 42 low-confidence finding(s)
low env_fs — Environment-variable access. 11 locations
low env_fs — Filesystem access. 6 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 25 locations
tauri-plugin-clipboard-manager
rust dependencyexpand_more 1 low-confidence finding(s)
if !(cfg!(docsrs) && std::env::var("TARGET").unwrap().contains("android")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-dialog
rust dependencyexpand_more 1 low-confidence finding(s)
if !(cfg!(docsrs) && std::env::var("TARGET").unwrap().contains("android")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-notification
rust dependencyexpand_more 1 low-confidence finding(s)
if !(cfg!(docsrs) && std::env::var("TARGET").unwrap().contains("android")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-opener
rust dependencyexpand_more 1 low-confidence finding(s)
let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-single-instance
rust dependencyexpand_more 4 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 4 locations
tauri-plugin-updater
rust dependencyexpand_more 24 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 18 locations
low env_fs — Filesystem access. 2 locations
tauri-plugin-window-state
rust dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
tokio
rust dependencyexpand_more 4 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
match std::env::var(ENV_WORKER_THREADS) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- @streamdown/code prod — dist-only: no readable source
- @streamdown/math prod — dist-only: no readable source
- @streamdown/mermaid prod — dist-only: no readable source
- @xyflow/react prod — dist-only: no readable source
- motion prod — dist-only: no readable source
- tw-animate-css prod — no javascript source
- tw-shimmer prod — no javascript source
- oxlint prod — dist-only: no readable source
- triton prod — no sdist (wheels only)
- triton-windows prod — no sdist (wheels only)
- torchcodec prod — no sdist (wheels only)
- torchvision prod — no sdist (wheels only)
- bitsandbytes prod — no sdist (wheels only)
- unsloth prod — sdist exceeds byte cap
- pytorch_triton_xpu prod — pypi 404
- torch prod — no sdist (wheels only)
- triton-xpu prod — no sdist (wheels only)
- pymupdf prod — sdist exceeds byte cap
- fix-path-env prod — cdn 403