Close Open Privacy Scan
App Privacy Score
High risk · 1802 finding(s)
Based on: 1 first-party package(s) · 14/16 deps analyzed
Dependency score: 72 (Medium risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz Potential data exfiltration in application code
External domains:
1.2.3.4academic.oup.comaclweb.orgaddress.localaggregate.ee.engr.uky.eduanaconda-repo.devanaconda.comanaconda.organalyticphysics.comapi.anaconda.orgapi.figshare.comapi.github.comapi.nuget.orgarchive.ics.uci.eduarrow.apache.orgarstechnica.comartowen.su.domainsarxiv.orgavatars2.githubusercontent.combar.combitbucket.orgblogs.mathworks.combmva-archive.org.ukbugreports.qt.iobugs.python.orgbugs.winehq.orgbugzilla.gnome.orgbugzilla.redhat.comcc0textures.comcdn.datatables.netcdn.jsdelivr.netcdn.mathjax.orgcdn.plot.lycdn.rawgit.comcdn.struffelproductions.comcdnjs.cloudflare.comcellprofiler.orgcens.ioc.eecgi.di.uoa.grchart-studio.plotly.comciteseerx.ist.psu.educmm.ensmp.frcode.google.comcode.jquery.comcollaboration.cmc.ec.gc.cacolorbrewer2.orgcommons.wikimedia.orgcommunity.plot.lyconda.anaconda.orgconda.iocoverage.readthedocs.iocran.r-project.orgcrates.iocreativecommons.orgcs.nyu.educseweb.ucsd.educve.mitre.orgcvlab.epfl.chcython.orgcython.readthedocs.iod3js.orgdash.plot.lydask.pydata.orgdata-apis.orgdataverse.orgdeveloper.mozilla.orgdigitalassets.lib.berkeley.edudistributed.dask.orgdl.acm.orgdmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdocs.bodo.aidocs.dask.orgdocs.enthought.comdocs.github.comdocs.mapbox.comdocs.microsoft.comdocs.pola.rsdocs.pytest.orgdocs.python.orgdocs.rapids.aidocs.rsdocs.scipydocs.scipy.orgdocs.sqlalchemy.orgdoi.orgdspace.mit.eduduckdb.orgen.cppreference.comen.wikipedia.orgen.wikiversity.orgen.wiktionary.orgentropymine.comepub.ub.uni-muenchen.deepubs.siam.orgexslt.orgfa.bianp.netfiji.scflic.krforum.image.scftp.iis.sinica.edu.twgcc.gnu.orggeoffboeing.comggplot2.tidyverse.orggist.github.comgithub.comgitlab.comgitlab.freedesktop.orggraphics.stanford.edugroups.google.comhal.archives-ouvertes.frhal.inria.frhastie.su.domainshdl.handle.nethg.python.orghome.olemiss.eduhomepages.ecs.vuw.ac.nzhost.comhtml.spec.whatwg.orghttpbin.orghubblesite.orgi.stanford.eduieeexplore.ieee.orgimageio.readthedocs.ioimagej.netimages-wixmp-ed30a86b8c4ca887773594c2.wixmp.cominf.ufrgs.bripython.orgj3-fortran.orgjmlr.csail.mit.edujmlr.orgjoblib.readthedocs.iojournals.plos.orgjse.amstat.orgjson-schema.orglara.epfl.chlark-parser.readthedocs.iolear.inrialpes.frlib.stat.cmu.edulibsdl.orglink.springer.comlivelovely.comlvdmaaten.github.iomaplibre.orgmarkfairchild.orgmarshmallow.readthedocs.orgmathworld.wolfram.commatplotlib.orgmedium.commembers.chello.atmesonbuild.commetacpan.orgmicrosoft.commitpress.mit.edumplab.ucsd.edumrl.nyu.edumsdn.microsoft.commybinder.orgmypy.readthedocs.ionarwhals-dev.github.iondownloader.figshare.comnetpbm.sourceforge.netnicolas.limare.netnlp.stanford.edunumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnumpydoc.readthedocs.ioold.vscht.czopenclipart.orgopensource.orgpackages.msys2.orgpackaging.python.orgpages.cs.wisc.edupandas.pydata.orgpapers.nips.ccparquet.apache.orgpaulbourke.netpeak.telecommunity.compeople.cs.umass.edupeople.csail.mit.edupeople.eecs.berkeley.edupeople.iee.ihu.grpeps.python.orgpersonal.math.ubc.capillow.readthedocs.iopillow.readthedocs.orgpivchallenge.orgpixi.shplatformdirs.readthedocs.ioplot.lyplotly.compluggy.readthedocs.iopoynton.capresbrey.mit.eduprism.ucalgary.caproceedings.neurips.ccprojecteuclid.orgpsutil.readthedocs.iopygments.orgpyinstaller.readthedocs.iopyperclip.readthedocs.iopypi.anaconda.orgpypi.orgpypi.python.orgpytest.orgpython-lz4.readthedocs.iopython-poetry.orgraw.githubusercontent.comrefspecs.linuxfoundation.orgrepo.anaconda.comrepositories.cdlib.orgrob.schapire.netschemas.microsoft.comschematics.readthedocs.ioscikit-image.orgscikit-learn.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgseaborn.pydata.orgserverfault.comsetuptools.pypa.iosimpleitk.orgsipi.usc.edusites.google.comskops.readthedocs.iosome-repository.orgsome.domainsome.link.comsomething.comsourceware.orgspacetelescope.github.iosparse.pydata.orgspecs.frictionlessdata.iostackoverflow.comstat.uw.edustats.stackexchange.comstatweb.stanford.edusupport.sas.comtechnet.microsoft.comtel.archives-ouvertes.frtinyurl.comtminka.github.iotoblerity.orgtog.acm.orgtools.ietf.orgtrifacta.github.comtruststore.readthedocs.iotwitter.comtyping.python.orgupload.pypi.orguser.engineering.uiowa.eduusers.cs.cf.ac.ukusers.jyu.fiusers.polytech.unice.frvassarstats.netviews.scientific-python.orgvincentarelbundock.github.iovis-www.cs.umass.eduvita.had.co.nzweb.archive.orgweb.math.ucsb.eduweb.stanford.eduwiki.cython.orgwiki.python.orgwixtoolset.orgwrapdb.mesonbuild.comwrobstory.github.ioww3.math.ucla.eduwww.ams.orgwww.apache.orgwww.astropy.orgwww.bestofmedia.comwww.bramvandersanden.comwww.brooklynmuseum.orgwww.brucelindbloom.comwww.busim.ee.boun.edu.trwww.cbsr.ia.ac.cnwww.cl.cam.ac.ukwww.clear.rice.eduwww.codeproject.comwww.conda.iowww.cosc.canterbury.ac.nzwww.cs.cornell.eduwww.cs.princeton.eduwww.cs.qub.ac.ukwww.cs.sfu.cawww.cs.technion.ac.ilwww.cs.toronto.eduwww.cs.ubc.cawww.cs.ucl.ac.ukwww.cs.waikato.ac.nzwww.csie.ntu.edu.twwww.data-publica.comwww.dbs.ifi.lmu.dewww.deviantart.comwww.di.ens.frwww.dirkpadfield.comwww.easyrgb.comwww.ece.rochester.eduwww.ece.ucsb.eduwww.ecma-international.orgwww.edwardrosten.comwww.eecs.tufts.eduwww.epfl.chwww.fatiando.orgwww.figshare.comwww.flickr.comwww.fordfoundation.orgwww.freedesktop.orgwww.gaussianprocess.orgwww.gdal.orgwww.godbole.netwww.google.comwww.graphviz.orgwww.ietf.orgwww.intel.comwww.ipol.imwww.isca-archive.orgwww.iucnredlist.orgwww.iwaenc.orgwww.janeriksolem.netwww.jmlr.orgwww.jstatsoft.orgwww.jstor.orgwww.mapbox.comwww.mars.comwww.math.hmc.eduwww.mathjax.orgwww.mathworks.comwww.mecourse.comwww.merl.comwww.microsoft.comwww.miketipping.comwww.mit.eduwww.mitpressjournals.orgwww.mlpack.orgwww.nasa.govwww.ncbi.nlm.nih.govwww.oasis-open.orgwww.openblas.netwww.openml.orgwww.opm.govwww.oreilly.comwww.osapublishing.orgwww.picloud.comwww.poynton.comwww.python.orgwww.rdocumentation.orgwww.research.ibm.comwww.researchgate.netwww.rfc-editor.orgwww.robots.ox.ac.ukwww.sciencedirect.comwww.scipy.orgwww.some-server.orgwww.somewhere.comwww.sphinx-doc.orgwww.springer.comwww.sri.comwww.stat.berkeley.eduwww.stat.ubc.cawww.stata.comwww.statsmodels.orgwww.stixfonts.orgwww.tandfonline.comwww.textualize.iowww.tu-chemnitz.dewww.utstat.toronto.eduwww.vision.cs.chubu.ac.jpwww.w3.orgwww.x.orgwww.xyz.eduwww.yhat.comwww.zenodo.orgwww5.cs.fau.dexarray.pydata.orgxkcd.comxlrd.readthedocs.ioyadda.icm.edu.plzenodo.org
- 1source
repo/build_tools/get_comment.py:266 - 2sink
repo/build_tools/get_comment.py:331
- 1source
repo/build_tools/github/autoclose_prs.py:25 - 2sink
repo/build_tools/github/autoclose_prs.py:38
- 1source
repo/build_tools/github/autoclose_prs.py:25 - 2sink
repo/build_tools/github/autoclose_prs.py:47
- 1source
repo/build_tools/github/autoclose_prs.py:25 - 2sink
repo/build_tools/github/autoclose_prs.py:61
</> First-Party Code
first-party (python)
python first-party print(message)PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
print(f"Found {len(prs)} opened PRs with label {label}")PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
print(f"Found {len(prs)} PRs to autoclose")PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
print(f"Closing PR #{pr.number} with comment")PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 102 low-confidence finding(s)
low env_fs — Environment-variable access. 46 locations
low pii_flow — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime. 2 locations
low env_fs — Filesystem access. 46 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 7 locations
response = requests.get("https://peps.python.org/api/release-cycle.json")Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
</> Dependencies
rich
python dependency yield from progress.track(
sequence,
total=total,
completed=completed,
description=description,
update_period=update_period,
)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 22 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
low env_fs — Filesystem access. 18 locations
conda-lock
python dependencyexpand_more 343 low-confidence finding(s)
low env_fs — Environment-variable access. 157 locations
low env_fs — Filesystem access. 164 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 22 locations
cython
python dependencyexpand_more 155 low-confidence finding(s)
low env_fs — Environment-variable access. 37 locations
low env_fs — Filesystem access. 114 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
with urlopen("https://api.github.com/rate_limit") as p:Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
joblib
python dependencyexpand_more 30 low-confidence finding(s)
low env_fs — Environment-variable access. 16 locations
low env_fs — Filesystem access. 14 locations
memory_profiler
python dependencyexpand_more 6 low-confidence finding(s)
path = os.getenv('PATH', os.defpath).split(os.pathsep)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
meson-python
python dependencyexpand_more 30 low-confidence finding(s)
low env_fs — Environment-variable access. 18 locations
low env_fs — Filesystem access. 12 locations
narwhals
python dependencyexpand_more 1 low-confidence finding(s)
terminal_width = int(os.getenv("COLUMNS", 80)) # noqa: PLW1508Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
numpy
python dependencyexpand_more 982 low-confidence finding(s)
low env_fs — Filesystem access. 618 locations
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57
low env_fs — Environment-variable access. 356 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 3 locations
pandas
python dependencyexpand_more 29 low-confidence finding(s)
low env_fs — Filesystem access. 12 locations
low env_fs — Environment-variable access. 16 locations
return urllib.request.urlopen(*args, **kwargs) # noqa: TID251Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
plotly
python dependencyexpand_more 33 low-confidence finding(s)
low env_fs — Environment-variable access. 16 locations
low env_fs — Filesystem access. 16 locations
response = post(server_url + "/", data=json_str)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
pooch
python dependencyexpand_more 15 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 6 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 6 locations
scikit-image
python dependencyexpand_more 25 low-confidence finding(s)
low env_fs — Environment-variable access. 6 locations
low env_fs — Filesystem access. 18 locations
with urllib.request.urlopen(resource_name) as u:Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
seaborn
python dependencyexpand_more 23 low-confidence finding(s)
low env_fs — Filesystem access. 15 locations
low env_fs — Environment-variable access. 6 locations
data = BytesIO(urlopen(url.format(pic)).read())Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
with urlopen(DATASET_NAMES_URL) as resp:Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
threadpoolctl
python dependencyexpand_more 1 low-confidence finding(s)
os.environ.setdefault("KMP_DUPLICATE_LIB_OK", "True")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- scipy prod — sdist exceeds byte cap
- matplotlib prod — sdist exceeds byte cap