Close Open Privacy Scan
App Privacy Score
Low risk · 211 finding(s)
Dependency score: 57 (Medium risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
169.254.169.254192.168.1.100687fb701029421ae5549d998--8000.hf.jobsabseil.ioaclanthology.orgagentskills.ioaggregate.ee.engr.uky.eduai.google.devaistudio.google.comanimations.devapi-inference.huggingface.coapi.anthropic.comapi.cerebras.aiapi.cohere.comapi.deepinfra.comapi.deepseek.comapi.endpoints.huggingface.cloudapi.featherless.aiapi.fireworks.aiapi.github.comapi.groq.comapi.mistral.aiapi.moonshot.aiapi.moonshot.cnapi.novita.aiapi.nuget.orgapi.openai.comapi.openai.com.attacker.comapi.publicai.coapi.replicate.comapi.scaleway.aiapi.slack.comapi.telegram.orgapi.together.xyzapi.wavespeed.aiapi.z.aiapp.neptune.aiarrow.apache.orgarstechnica.comarxiv.orgauai.orgawsdocs-neuron.readthedocs-hosted.combase-ui.combfl.aibit.lybitbucket.orgblackforestlabs.aiblog.fal.aiblog.famzah.netbootlin.combugreports.qt.iobugs.python.orgbugs.winehq.orgbugzilla.gnome.orgcdn-datasets.huggingface.cocdn-media.huggingface.cocdn.britannica.comcdn.mathjax.orgcdnjs.cloudflare.comcens.ioc.eecheck-host.netcivitai.comclaude.aiclear.mlclick.palletsprojects.comclip-cn-beijing.oss-cn-beijing.aliyuncs.comcode.activestate.comcodeload.github.comcolab.research.google.comcollaboration.cmc.ec.gc.cacoqui.aicore.telegram.orgcran.r-project.orgcrates.iocs-people.bu.educve.mitre.orgcyclopts.readthedocs.iod2drjpuinn46lb.cloudfront.netdagshub.comdashscope-intl.aliyuncs.comdashscope.aliyuncs.comdata-apis.orgdatasets-server.huggingface.codatatracker.ietf.orgdev-discuss.pytorch.orgdeveloper.android.comdeveloper.download.nvidia.comdeveloper.mozilla.orgdeveloper.nvidia.comdevelopers.google.comdigitalassets.lib.berkeley.edudiscord.comdiscordpy.readthedocs.iodiscuss.huggingface.codiscuss.python.orgdiscuss.pytorch.orgdl.acm.orgdmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdocs.bodo.aidocs.github.comdocs.h5py.orgdocs.microsoft.comdocs.neptune.aidocs.nvidia.comdocs.pydantic.devdocs.pytest.orgdocs.python.orgdocs.pytorch.orgdocs.ray.iodocs.rsdocs.scipy.orgdocs.sqlalchemy.orgdocs.swanlab.cndocs.unsloth.aidocs.wandb.aidoi.orgdownload.pytorch.orgdvc.orgen.ig.maen.wikipedia.orgen.wikiversity.orgencrypted-tbn0.gstatic.comendpoints.huggingface.coerrors.pydantic.devessentia.upf.eduevents.telemetry.data.nvidia.comexam_ple.comexslt.orgfacebookresearch.github.iofal.runfarm4.staticflickr.comfiles.worldwildlife.orgfilesystem-spec.readthedocs.ioflax.readthedocs.ioflyte.orgfoo.comformulae.brew.shgcc.gnu.orggenerativelanguage.googleapis.comgiou.stanford.edugist.github.comgit-scm.comgit.kernel.orggithub.comgitlab.comgitlab.freedesktop.orggoo.glgraphics.stanford.edugroups.google.comguillaumejaume.github.iohermes-agent.nousresearch.comhf.cohips.hearstapps.comhost.comhtml.spec.whatwg.orghttpbin.orghub-ci.huggingface.cohub.docker.comhub.my-company.comhuggingface.cohyper.rshypothesis.readthedocs.ioi.postimg.cci2vgen-xl.github.ioicml.ccifconfig.meimageio.readthedocs.ioimages.cocodataset.orgimages.nvidia.comimages.pexels.cominference.api.nscale.comipython.orgipywidgets.readthedocs.ioj3-fortran.orgjax.readthedocs.iojoschu.netjson-schema.orgjsonlines.orgjzgu0buei5.us-east-1.aws.endpoints.huggingface.cloudkeras.iokexue.fmlaion.ailh3.googleusercontent.comlibrosa.orglibsdl.orglinuxdevcenter.comlists.sourceforge.netmail.python.orgmarc.najork.orgmarigoldcomputervision.github.iomarigoldmonodepth.github.iomathworld.wolfram.commatplotlib.orgmcp.context7.commcp.exa.aimedia.githubusercontent.commesonbuild.commetacpan.orgmetadata.google.internalmistralai.github.iomy-text-to-image.region.vendor.endpoints.huggingface.cloudmy-vllm-server.commypy.readthedocs.ionats.iondjson.orgnew-url.comnew.webhook.sitenicolas.limare.netnineplanets.orgnlp.stanford.edunodejs.orgnpmjs.comnumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnumpydoc.readthedocs.ioo7ywnmrahorts457.us-east-1.aws.endpoints.huggingface.cloudoai.endpoints.kepler.ai.cloud.ovh.netomoindrot.github.ioonnxruntime.aiopenclaw.aiopencode.aiopenreview.netopenrouter.aioptuna.readthedocs.iopackages.msys2.orgpackaging.python.orgpaddle-model-ecology.bj.bcebos.compandas.pydata.orgpapers.nips.ccparquet.apache.orgpbs.twimg.compenghao-bdsc.github.iopeople.eecs.berkeley.edupeps.python.orgpersonal.math.ubc.capillow.readthedocs.ioplatform.claude.complatform.kimi.aiplatform.openai.compresbrey.mit.eduproceedings.neurips.ccprotobuf.devptccx55jz97f9zgo.us-east-1.aws.endpoints.huggingface.cloudpublic.ukp.informatik.tu-darmstadt.depurl.oclc.orgpydantic-docs.helpmanual.iopygments.orgpyinstaller.readthedocs.iopymupdf.readthedocs.iopyperclip.readthedocs.iopypi.orgpython-devtools.helpmanual.iopytorch.orgpyyaml.orgq1bj3bpq6kzilnsu.us-east-1.aws.endpoints.huggingface.cloudqc6479g0aac6qwy9.us-east-1.aws.endpoints.huggingface.cloudqianwen-res.oss-cn-beijing.aliyuncs.comqueue.fal.runqwenlm.github.ioraw.githubusercontent.comreact-resizable-panels-au2wmqbbr-brian-vaughns-projects.vercel.appreact-resizable-panels-ca7gk2gh5-brian-vaughns-projects.vercel.appreact-resizable-panels.vercel.appreact-virtualized-auto-sizer.vercel.appreact.devreactjs.orgredux.js.orgrefspecs.linuxfoundation.orgremote-text-encoder-flux-2.huggingface.corepo.amd.comrequests.readthedocs.ioresources.nvidia.comrich.readthedocs.iorocm.docs.amd.comrouter.huggingface.corrc.cvc.uab.ess3.amazonaws.comsafetensors-convert.hf.spacesbert.netschemas.microsoft.comschemas.openxmlformats.orgschemas.zwobble.orgscikit-image.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgserverfault.comsonner.emilkowal.skisourceware.orgspecs.frictionlessdata.iospherelab.aistackoverflow.comstatus.huggingface.costorage.googleapis.comstuk.github.iosuno-ai.notion.sitesupport.sas.comswanlab.cntailwindcss.comtest.pypi.orgtestpypi.python.orgthumbs.dreamstime.comtldp.orgtqdm.github.iotriton-lang.orgtruststore.readthedocs.iotvm.apache.orgtwitter.comtyper.tiangolo.comtyping.python.orgunsloth.aiupload.wikimedia.orguser-images.githubusercontent.comviews.scientific-python.orgweave-docs.wandb.aiweb.archive.orgwebhook.sitewhhx50ex1aryqvw6.us-east-1.aws.endpoints.huggingface.cloudwixtoolset.orgwrapdb.mesonbuild.comwww.aclweb.orgwww.aiml.informatik.tu-darmstadt.dewww.ams.orgwww.artifex.comwww.arxiv.orgwww.brynosaurus.comwww.comet.comwww.cs.cmu.eduwww.deepmind.comwww.deepspeed.aiwww.desmos.comwww.dvc.orgwww.ecma-international.orgwww.example.珠宝www.gnu.orgwww.google.comwww.ietf.orgwww.ilankelman.orgwww.intel.comwww.json.orgwww.kxan.comwww.math.hmc.eduwww.mathjax.orgwww.mathworks.comwww.microsoft.comwww.mlflow.orgwww.nature.comwww.nvidia.comwww.oasis-open.orgwww.openblas.netwww.opm.govwww.oreilly.comwww.paddleocr.aiwww.python-httpx.orgwww.python.orgwww.researchgate.netwww.sbert.netwww.scipy.orgwww.scivision.devwww.stata.comwww.statsmodels.orgwww.stixfonts.orgwww.systutorials.comwww.tensorflow.orgwww.textualize.iowww.w3.orgwww.wandb.comwww.xudongz.comwww.xyz.eduwww.аррӏе.comx.comx2dmsqunjd6k9prw.us-east-1.aws.endpoints.huggingface.cloudxarray.pydata.orgxjqqhmyn62rog84g.us-east-1.aws.endpoints.huggingface.cloudxlrd.readthedocs.ioyou-seta.hf.space
</> First-Party Code
first-party (rust): studio/src-tauri
rust first-partyexpand_more 45 low-confidence finding(s)
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
match std::fs::read_to_string(path) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
std::fs::write(&trimmed, " desktop-secret\n").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
std::fs::write(&invalid, [0xff, 0xfe]).unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let raw = std::fs::read_to_string(managed_studio_root_id_path(&home)).ok()?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
std::fs::write(path, body).map_err(|e| e.to_string())Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let raw = match std::fs::read(path) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
match std::fs::read_to_string(auth_secret_path_for_home(&home)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let response = match client.get(DESKTOP_UPDATER_CHANNEL_URL).send().await {Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
log::warn!("Manual update metadata check failed: {}", error);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::warn!(
"Manual update metadata check returned HTTP {}",
response.status()
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let mut file = File::open(path).ok()?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(
&old,
"diag_schema=1\nflow=install\nattempt_id=old\nsegment_index=1\nstarted_at_ms=1\n--- log ---\nold\n",
)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(
&new,
"diag_schema=1\nflow=install\nattempt_id=new\nsegment_index=1\nstarted_at_ms=2\n--- log ---\nnew\n",
)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let mut file = File::open(path).map_err(|e| e.to_string())?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, [0xff, b'a', b'\n', b'b']).unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, b"gguf").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, b"gguf").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, b"gguf").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, b"changed").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, b"gguf").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&target, b"gguf").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, b"gguf").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&path, b"not gguf").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&bin, script).unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let previous = std::env::var_os("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
std::env::var_os("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let first_calls = fs::read_to_string(&calls).unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&modecap, "broken").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&calls, "").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&modeh, "broken").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&calls, "").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::read(path)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if let Some(home) = std::env::var_os("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME") {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let bytes = fs::read(path).ok()?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if let Err(error) = fs::write(&path, bytes) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&new_bin, "").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(&old_bin, "").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("APPIMAGE").is_some() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
</> Dependencies
base64
rust dependencyexpand_more 1 low-confidence finding(s)
Some(f) => Box::new(File::open(f).unwrap()),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
dirs
rust dependencyexpand_more 6 low-confidence finding(s)
pub fn cache_dir() -> Option<PathBuf> { env::var_os("XDG_CACHE_HOME") .and_then(dirs_sys::is_absolute_path).or_else(|| home_dir().map(|h| h.join(".cache"))) }Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pub fn config_dir() -> Option<PathBuf> { env::var_os("XDG_CONFIG_HOME").and_then(dirs_sys::is_absolute_path).or_else(|| home_dir().map(|h| h.join(".config"))) }Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pub fn data_dir() -> Option<PathBuf> { env::var_os("XDG_DATA_HOME") .and_then(dirs_sys::is_absolute_path).or_else(|| home_dir().map(|h| h.join(".local/share"))) }Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pub fn runtime_dir() -> Option<PathBuf> { env::var_os("XDG_RUNTIME_DIR").and_then(dirs_sys::is_absolute_path) }Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pub fn state_dir() -> Option<PathBuf> { env::var_os("XDG_STATE_HOME") .and_then(dirs_sys::is_absolute_path).or_else(|| home_dir().map(|h| h.join(".local/state"))) }Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pub fn executable_dir() -> Option<PathBuf> { env::var_os("XDG_BIN_HOME") .and_then(dirs_sys::is_absolute_path).or_else(|| home_dir().map(|h| h.join(".local/bin"))) }Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
reqwest
rust dependencyexpand_more 42 low-confidence finding(s)
log::debug!("rustls failed to parse DER certificate: {err:?}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
let file = File::open(path).await?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let req = client
.get("https://hyper.rs")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let req = client
.get(some_url)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let builder = client
.post("http://httpbin.org/post")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let builder = client.get("http://httpbin.org/get");Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let builder = client
.get("http://httpbin.org/get")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let req = client.get(some_url).build().expect("request build");Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
client.get("http://example.com")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let file = File::open(path)?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let r = client.get(some_url).build().unwrap();Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url).build().unwrap();Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.put(some_url).build().unwrap();Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut r = client.get(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let r = client.post(some_url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let req = client
.get("https://hyper.rs")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let req = client
.get(some_url)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let req = client.get(some_url).build().expect("request build");Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
log::debug!("proxy({proxy:?}) intercepts '{dst:?}'");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("starting new connection: {dst:?}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
let raw = std::env::var("NO_PROXY")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
.or_else(|_| std::env::var("no_proxy"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::debug!("retryable but could not withdraw from budget");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
let pem_bundle = std::fs::read("tests/support/crl.pem").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let mut req = client
.get("https://www.example.com")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut req = client
.get("https://www.example.com")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut req2 = client
.get("https://www.example.com/x")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut req = client
.get("https://www.example.com")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
let mut req2 = client
.get("https://www.example.com")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
serde
rust dependencyexpand_more 4 low-confidence finding(s)
let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let patch_version = env::var("CARGO_PKG_VERSION_PATCH").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fs::write(out_dir.join("private.rs"), module).unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let rustc = env::var_os("RUSTC")?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
serde_json
rust dependencyexpand_more 2 low-confidence finding(s)
let target_arch = env::var_os("CARGO_CFG_TARGET_ARCH").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let target_pointer_width = env::var_os("CARGO_CFG_TARGET_POINTER_WIDTH").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
simplelog
rust dependencyexpand_more 31 low-confidence finding(s)
error!("Magenta error");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
warn!("Yellow warning");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
info!("Blue info");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
debug!("Cyan debug");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
error!("Red error");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
warn!("Yellow warning");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
info!("Blue info");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
debug!("Cyan debug");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
error!("Red error");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
warn!("Orange warning");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
info!("Yellow info");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
debug!("Dark green debug");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
error!("Bright red error");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
info!("This only appears in the log file");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
debug!("This level is currently not enabled for any logger");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
File::create("thread_naming.log").unwrap(),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::create(&format!("error_{}.log", i)).unwrap(),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::create(&format!("warn_{}.log", i)).unwrap(),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::create(&format!("info_{}.log", i)).unwrap(),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::create(&format!("debug_{}.log", i)).unwrap(),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::create(&format!("trace_{}.log", i)).unwrap(),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
error!("Test Error");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
warn!("Test Warning");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
info!("Test Information");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
debug!("Test Debug");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
File::open("thread_naming.log")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::open(&format!("error_{}.log", j))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::open(&format!("warn_{}.log", j))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::open(&format!("info_{}.log", j))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::open(&format!("debug_{}.log", j))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
File::open(&format!("trace_{}.log", j))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri
rust dependencyexpand_more 42 low-confidence finding(s)
std::env::var(format!("CARGO_FEATURE_{}", AsShoutySnakeCase(feature)))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
std::fs::write(
checked_features_out_path,
CHECKED_FEATURES.get().unwrap().lock().unwrap().join(","),
)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let target_env = std::env::var("CARGO_CFG_TARGET_ENV");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let is_tauri_workspace = std::env::var("__TAURI_WORKSPACE__").is_ok_and(|v| v == "true");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
std::env::var(var).unwrap_or_else(|_| {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if let Ok(kotlin_out_dir) = std::env::var("WRY_ANDROID_KOTLIN_FILES_OUT_DIR") {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let content = fs::read_to_string(file.path())Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if let Some(project_dir) = env::var_os("TAURI_ANDROID_PROJECT_PATH").map(PathBuf::from) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let package_unescaped = env::var("TAURI_ANDROID_PACKAGE_UNESCAPED")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
std::fs::write(
project_dir.join("app").join("proguard-tauri.pro"),
tauri_proguard,
)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
PathBuf::from(std::env::var_os("CARGO_MANIFEST_DIR").unwrap()).join("mobile/android");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
PathBuf::from(std::env::var_os("CARGO_MANIFEST_DIR").unwrap()).join("mobile/ios-api");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return std::fs::read(asset_path).ok().map(|bytes| {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::error!("failed to exit: {}", e);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("restart triggered on the main thread");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("restart triggered from a separate thread");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("failed to request exit: {e}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
let bytes = std::fs::read(path)?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::debug!("Unknown CspHash variant encountered: {:?}", _csp_hash);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("Asset `{path}` not found; fallback to {path}.html");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("Asset `{path}` not found; fallback to {path}/index.html",);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("Asset `{path}` not found; fallback to index.html");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("{error}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("failed to get file name from URI: {e}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("failed to restart app: {e}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("failed to restart app: {e}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("asset protocol path \"{}\" is not valid: {}", path, e);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("asset protocol not configured to allow the path: {}", path);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
let mut file = match File::open(path.clone()) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::error!("Failed to open Android external storage file '{}': {}. This may be due to missing storage permissions.", path, e);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("File does not exist at path: {}", path);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("Missing OS permission to access path \"{}\": {}", path, e);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::info!("adding dev server root certificate");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::warn!(
"the dev root-certificate-path option was provided, but you must enable one of the following Tauri features in Cargo.toml: native-tls, native-tls-vendored, rustls-tls"
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::warn!(
"loading HTTPS URL; you might need to provide a certificate via the `dev --root-certificate-path` option. You must enable one of the following Tauri features in Cargo.toml: native-tls, native-tls-vendored, rustls-tls"
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("{error_message}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tracing::error!("failed to resolve data directory");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tracing::error!(
"data_directory `{}` is not a safe path, ignoring config. Validation error was: {_err}",
data_directory.display()
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tracing::error!(
"data_directory `{}` is not a relative path, ignoring config.",
data_directory.display()
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tracing::error!(
"__TAURI_INVOKE_KEY__ expected {expected} but received {}",
request.invoke_key
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tauri-plugin-clipboard-manager
rust dependencyexpand_more 1 low-confidence finding(s)
if !(cfg!(docsrs) && std::env::var("TARGET").unwrap().contains("android")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-dialog
rust dependencyexpand_more 1 low-confidence finding(s)
if !(cfg!(docsrs) && std::env::var("TARGET").unwrap().contains("android")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-notification
rust dependencyexpand_more 1 low-confidence finding(s)
if !(cfg!(docsrs) && std::env::var("TARGET").unwrap().contains("android")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-opener
rust dependencyexpand_more 1 low-confidence finding(s)
let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tauri-plugin-single-instance
rust dependencyexpand_more 4 low-confidence finding(s)
tracing::debug!(
"single_instance failed to notify - launching normally: {}",
e
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tracing::debug!("single_instance failed to be notified: {e}")A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tracing::debug!("single_instance failed to be notified: {}", err);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tracing::error!(
"single_instance failed to listen to other processes - launching normally: {}",
err
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tauri-plugin-updater
rust dependencyexpand_more 24 low-confidence finding(s)
let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("SSL_CERT_FILE").is_none() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if std::env::var_os("SSL_CERT_DIR").is_none() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::debug!("checking for updates {url}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("disabling proxy");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("using proxy {proxy}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("update endpoint returned 204 No Content");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("update response: {update_response:?}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("parsed release response {release:?}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("failed to deserialize update response: {err}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!(
"update endpoint did not respond with a successful status code"
);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::error!("failed to check for updates: {err}");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("Searching for updater target '{target}' in release data");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("running on_before_exit hook");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
WindowsUpdaterType::Msi { .. } => std::env::var("SYSTEMROOT").as_ref().map_or_else(Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::debug!("extracting AppImage");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("rewriting AppImage");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
return match std::fs::write(&self.extract_path, bytes)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::warn!("update is not a valid deb package");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
if std::fs::write(&pkg_path, bytes).is_ok() {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
log::debug!("installed {pkg_path:?} with pkexec");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("installed {pkg_path:?} with GUI sudo");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("installed {pkg_path:?} with sudo");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
log::debug!("app installation needs admin privileges");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
tauri-plugin-window-state
rust dependencyexpand_more 2 low-confidence finding(s)
std::fs::write(state_path, serde_json::to_vec_pretty(&*state)?)?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
let file = std::fs::File::open(state_path)?;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
tokio
rust dependencyexpand_more 4 low-confidence finding(s)
asyncify(move || std::fs::read(path)).awaitReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
asyncify(move || std::fs::read_to_string(path)).awaitReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
asyncify(move || std::fs::write(path, contents)).awaitReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
match std::env::var(ENV_WORKER_THREADS) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- @fontsource-variable/figtree prod — no javascript source
- @fontsource-variable/inter prod — no javascript source
- @fontsource-variable/space-grotesk prod — no javascript source
- @streamdown/code prod — dist-only: no readable source
- @streamdown/math prod — dist-only: no readable source
- @streamdown/mermaid prod — dist-only: no readable source
- @xyflow/react prod — dist-only: no readable source
- motion prod — dist-only: no readable source
- shadcn prod — dist-only: no readable source
- tw-animate-css prod — no javascript source
- tw-shimmer prod — no javascript source
- oxlint prod — dist-only: no readable source
- triton prod — no sdist (wheels only)
- triton-windows prod — no sdist (wheels only)
- unsloth prod — sdist exceeds byte cap
- torchvision prod — no sdist (wheels only)
- bitsandbytes prod — no sdist (wheels only)
- pytorch_triton_xpu prod — pypi 404
- torch prod — no sdist (wheels only)
- triton-xpu prod — no sdist (wheels only)
- pymupdf prod — sdist exceeds byte cap
- fix-path-env prod — cdn 403