Close Open Privacy Scan
App Privacy Score
97
/100
Low privacy risk
Low risk · 2651 finding(s)
Based on: 1 first-party package(s) · 13/16 deps analyzed
Dependency score: 47 (High risk)
bar_chart Score Breakdown
env_fs
−3
list Scan Summary
0 high
3 medium
2648 low
First-party packages:
1
Dependency packages:
13
Ecosystem:
python
swap_horiz Application data flows
No application data flows were found. See dependency data flows below.
hub Dependency data flows (1)
medium
transformers
dependency
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
- 1source
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 - 2sink
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
</> First-Party Code
first-party (python)
python first-partyexpand_more 104 low-confidence finding(s)
low env_fs — Environment-variable access. 57 locations
low env_fs — Filesystem access. 45 locations
low pii_flow — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime. 2 locations
</> Dependencies
accelerate
python dependency
medium
telemetry
dependency
Excluded from app score
#b9180fc86c132db2
capability detected · no path traced
—
Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/accelerate/tracking.py:650
self.writer.track(value, name=key, step=step, **kwargs)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium
telemetry
dependency
Excluded from app score
#92ea12aa37c96661
capability detected · no path traced
—
Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/src/accelerate/tracking.py:682
self.writer.track(aim_image, name=key, step=step, **track_kw)A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 226 low-confidence finding(s)
low env_fs — Filesystem access. 31 locations
low env_fs — Environment-variable access. 195 locations
transformers
python dependency
medium
pii_flow
dependency
Excluded from app score
#ba1dac3f508c58d2
—
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
· flow /tmp/closeopen-wsmsf4if/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 → /tmp/closeopen-wsmsf4if/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
logger.debug(f"[Kubeflow] Token file not found: {token_path}")PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 399 low-confidence finding(s)
low env_fs — Filesystem access. 249 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 13 locations
low env_fs — Environment-variable access. 136 locations
low
egress
dependency
Excluded from app score
#dfe546d4b4cf8563
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/transformers/utils/attention_visualizer.py:183
img = Image.open(io.BytesIO(httpx.get(img, follow_redirects=True).content))Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
datasets
python dependencyexpand_more 77 low-confidence finding(s)
low env_fs — Filesystem access. 52 locations
low env_fs — Environment-variable access. 25 locations
huggingface_hub
python dependencyexpand_more 185 low-confidence finding(s)
low env_fs — Filesystem access. 64 locations
low env_fs — Environment-variable access. 57 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 62 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
numpy
python dependencyexpand_more 982 low-confidence finding(s)
low env_fs — Filesystem access. 618 locations
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57
low env_fs — Environment-variable access. 356 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 3 locations
packaging
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
peft
python dependencyexpand_more 12 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 8 locations
psutil
python dependencyexpand_more 28 low-confidence finding(s)
low env_fs — Filesystem access. 19 locations
low env_fs — Environment-variable access. 7 locations
low
egress
tooling
Excluded from app score
unreachable
#ebd390fdf893b9b2
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:194
res = requests.get(url, timeout=REQUEST_TIMEOUT)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low
egress
tooling
Excluded from app score
unreachable
#6c793c07ef5f8207
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/install_pip.py:34
req = urlopen(URL, **kwargs)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
pytest
python dependencyexpand_more 437 low-confidence finding(s)
low env_fs — Environment-variable access. 76 locations
low env_fs — Filesystem access. 356 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
pyyaml
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
safetensors
python dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 9 locations
setuptools
python dependencyexpand_more 163 low-confidence finding(s)
low env_fs — Environment-variable access. 79 locations
low env_fs — Filesystem access. 82 locations
low
egress
dependency
Excluded from app score
#07fbe99d63eedf87
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/setuptools/_vendor/jaraco/context/__init__.py:78
req = urllib.request.urlopen(url)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low
egress
dependency
Excluded from app score
#a0dc935ffc88e331
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/setuptools/config/_validate_pyproject/formats.py:158
with urlopen(url, context=context) as response: # noqa: S310 (audit URLs)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
tqdm
python dependencyexpand_more 20 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low env_fs — Environment-variable access. 5 locations
Skipped dependencies
Production
- torch prod — no sdist (wheels only)
- bitsandbytes prod — no sdist (wheels only)
- scipy prod — sdist exceeds byte cap