Close Open Privacy Scan
App Privacy Score
—
/100
Not analyzed — coverage too low
Coverage too low to score · 409 finding(s)
Based on: 25 first-party package(s) · 110/227 deps analyzed
bar_chart Score Breakdown
telemetry
−25
env_fs
−3
list Scan Summary
0 high
0 medium
409 low
First-party packages:
6
Dependency packages:
12
Ecosystem:
rust
swap_horiz Application data flows
Not enough of this repository was analyzed to look for application data flows. Absence of findings here is not evidence of a clean result.
</> First-Party Code
first-party (python): rust/sglang-grpc
rust first-partyexpand_more 27 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 24 locations
first-party (python): rust/sglang-mm
rust first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#7983add1d39c22d8
capability detected · no path traced
—
Environment-variable access.
repo/rust/sglang-mm/src/common/mod.rs:13
let n = std::env::var("SGL_MM_RS_THREADS")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (python): rust/sglang-server
rust first-partyexpand_more 2 low-confidence finding(s)
low
env_fs
production
#ad089cc32e587e14
capability detected · no path traced
—
Environment-variable access.
repo/rust/sglang-server/src/environ.rs:31
let Ok(raw) = std::env::var(name) else {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low
telemetry
production
#5510fbf2a465a953
capability detected · no path traced
—
Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/rust/sglang-server/src/environ.rs:37
tracing::warn!(name, value = %raw, ?default, "invalid env value; using default");A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
first-party (rust): experimental/sgl-router
rust first-partyexpand_more 69 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 65 locations
first-party (rust): sgl-model-gateway
rust first-partyexpand_more 53 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 7 locations
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 43 locations
first-party (rust): sgl-model-gateway/bindings/golang
rust first-partyexpand_more 1 low-confidence finding(s)
low
telemetry
production
#93014f7b06e5feb8
capability detected · no path traced
—
Log/trace emission. Structured logs can carry PII to sinks/aggregators.
repo/sgl-model-gateway/bindings/golang/src/grpc_converter.rs:573
tracing::warn!("Tool parser error: {}", e);A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
</> Dependencies
apache-tvm-ffi
rust dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 8 locations
fastokens
rust dependencyexpand_more 13 low-confidence finding(s)
low env_fs — Filesystem access. 12 locations
low
env_fs
dependency
Excluded from app score
#8608900c068b4ad4
capability detected · no path traced
—
Environment-variable access.
pkgs/rust/[email protected]/src/lib.rs:1367
let progress = std::env::var("EXTENDED_PROGRESS").is_ok();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
granian
rust dependencyexpand_more 17 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 11 locations
low env_fs — Filesystem access. 6 locations
libc
rust dependencyexpand_more 12 low-confidence finding(s)
low env_fs — Environment-variable access. 12 locations
llguidance
rust dependencyexpand_more 16 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
low env_fs — Environment-variable access. 3 locations
low
egress
dependency
Excluded from app score
#36bd23bc46a843bb
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/parser/src/json/schema.rs:1269
let val = defs.get(key).unwrap();Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 2 locations
openai-harmony
rust dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 2 locations
openmetrics-parser
rust dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
openssl
rust dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
orjson
rust dependencyexpand_more 106 low-confidence finding(s)
low env_fs — Environment-variable access. 84 locations
low env_fs — Filesystem access. 22 locations
py-spy
rust dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
redis
rust dependencyexpand_more 1 low-confidence finding(s)
low
env_fs
tooling
reachable
#8618cb8e107c6062
capability detected · no path traced
—
Environment-variable access.
pkgs/rust/[email protected]/examples/geospatial.rs:11
let redis_url = match env::var("REDIS_URL") {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
rmcp
rust dependencyexpand_more 60 low-confidence finding(s)
low telemetry — Log/trace emission. Structured logs can carry PII to sinks/aggregators. 60 locations
Skipped dependencies
Production
- cuda-python prod — no sdist (wheels only)
- decord2 prod — no sdist (wheels only)
- nvidia-cutlass-dsl prod — no sdist (wheels only)
- nvidia-mathdx prod — no sdist (wheels only)
- pillow prod — sdist exceeds byte cap
- scipy prod — sdist exceeds byte cap
- sgl-deep-gemm prod — no sdist (wheels only)
- sglang-kernel prod — no sdist (wheels only)
- tokenspeed_mla prod — no sdist (wheels only)
- torch prod — no sdist (wheels only)
- tilelang prod — sdist exceeds byte cap
- torchao prod — no sdist (wheels only)
- torchaudio prod — no sdist (wheels only)
- torchcodec prod — no sdist (wheels only)
- torchvision prod — no sdist (wheels only)
- runai-model-streamer prod — no sdist (wheels only)
- cache-dit prod — no sdist (wheels only)
- moviepy prod — sdist exceeds byte cap
- nvidia-modelopt prod — no sdist (wheels only)
- opencv-python-headless prod — sdist exceeds byte cap
- runai_model_streamer prod — no sdist (wheels only)
- st_attn prod — no sdist (wheels only)
- vsa prod — no sdist (wheels only)
- ray prod — no sdist (wheels only)
- sglang prod — no sdist (wheels only)
- triton prod — no sdist (wheels only)
- mooncake-transfer-engine-non-cuda prod — no sdist (wheels only)
- amd-sglang prod — no python source in sdist
- petit_kernel prod — no sdist (wheels only)
- wave-lang prod — no sdist (wheels only)
- torch_musa prod — pypi 404
- mthreads-ml-py prod — no sdist (wheels only)
- flash_attn_3 prod — no sdist (wheels only)
- github.com/sglang/sglang-go-grpc-sdk prod — proxy 404
- dynamo-protocols prod — no version pinned
- dynamo-tokenizers prod — no version pinned
- dynamo-parsers prod — no version pinned
- tokio prod — cdn 403
- axum prod — cdn 403
- tower prod — cdn 403
- tower-http prod — cdn 403
- reqwest prod — cdn 403
- serde_json prod — cdn 403
- serde prod — cdn 403
- hf-hub prod — cdn 403
- minijinja prod — cdn 403
- minijinja-contrib prod — cdn 403
- anyhow prod — cdn 403
- thiserror prod — cdn 403
- chrono prod — cdn 403
- clap prod — cdn 403
- tracing-subscriber prod — cdn 403
- futures prod — cdn 403
- tracing prod — cdn 403
- bytes prod — cdn 403
- rand prod — cdn 403
- tokio-stream prod — cdn 403
- dashmap prod — cdn 403
- kube prod — cdn 403
- k8s-openapi prod — cdn 403
- tokio-util prod — cdn 403
- uuid prod — cdn 403
- parking_lot prod — cdn 403
- rmp-serde prod — cdn 403
- sha2 prod — cdn 403
- url prod — cdn 403
- async-stream prod — no version pinned
- pyo3 prod — no version pinned
- zeromq prod — cdn 403
- prost prod — cdn 403
- tokenizers prod — cdn 403
- tonic prod — cdn 403
- base64 prod — cdn 403
- blake3 prod — cdn 403
- half prod — cdn 403
- image prod — cdn 403
- numpy prod — cdn 403
- tracing-appender prod — no version pinned
- rayon prod — cdn 403
- core_affinity prod — cdn 403
- regex-syntax prod — cdn 403
- rmpv prod — cdn 403
- http-body prod — cdn 403
- futures-util prod — cdn 403
- xxhash-rust prod — cdn 403
- bytemuck prod — cdn 403
- async-trait prod — cdn 403
- tracing-log prod — cdn 403
- opentelemetry prod — cdn 403
- opentelemetry_sdk prod — cdn 403
- opentelemetry-otlp prod — cdn 403
- tracing-opentelemetry prod — cdn 403
- regex prod — cdn 403
- memchr prod — cdn 403
- reasoning-parser prod — invalid crate version
- openai-protocol prod — invalid crate version
- tool-parser prod — invalid crate version
- llm-tokenizer prod — invalid crate version
- smg-auth prod — invalid crate version
- wfaas prod — invalid crate version
- data-connector prod — invalid crate version
- smg-mcp prod — invalid crate version
- smg-wasm prod — invalid crate version
- smg-mesh prod — invalid crate version
- rustls prod — cdn 403
- rustls-pemfile prod — cdn 403
- serde_yaml prod — cdn 403
- subtle prod — cdn 403
- jsonwebtoken prod — cdn 403
- num-traits prod — cdn 403
- openai-harmony prod — no version pinned
- num-bigint prod — cdn 403
- smg-grpc-client prod — invalid crate version
- crdts prod — cdn 403
- wasmtime prod — cdn 403
- sgl-model-gateway prod — no version pinned
- wit-bindgen prod — cdn 403