Close Open Privacy Scan

link https://github.com/github/github-mcp-server
bolt Snapshot: commit 9d13004
science engine v1.22
schedule 2026-07-21T12:10:21.104204+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

smart_toy MCP server detected: @modelcontextprotocol/ext-apps, github.com/modelcontextprotocol/go-sdk — detected in dependencies, not a safety judgment.

App Privacy Score

97 /100
Low privacy risk

Low risk · 92 finding(s)

Dependency score: 77 (Medium risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 1 medium 91 low
First-party packages: 1
Dependency packages: 8
Ecosystem: go

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)
medium github.com/modelcontextprotocol/go-sdk tooling PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/examples/server/distributed/main.go:91 → pkgs/go/[email protected]/examples/server/distributed/main.go:97

</> First-Party Code

first-party (go)

go first-party
expand_more 20 low-confidence finding(s)
low env_fs production #5d8de6a864ad6a27 — Filesystem access.
repo/cmd/github-mcp-server/feature_flag_docs.go:130 
	content, err := os.ReadFile(path) //#nosec G304

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #687e847a30854296 — Filesystem access.
repo/cmd/github-mcp-server/feature_flag_docs.go:138 
	return os.WriteFile(path, []byte(updated), 0600) //#nosec G306

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f90709af2416788d — Filesystem access.
repo/cmd/github-mcp-server/generate_docs.go:81 
	content, err := os.ReadFile(readmePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c15343811144672 — Filesystem access.
repo/cmd/github-mcp-server/generate_docs.go:99 
	err = os.WriteFile(readmePath, []byte(updatedContent), 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d1140d27d6d115d — Filesystem access.
repo/cmd/github-mcp-server/generate_docs.go:108 
	content, err := os.ReadFile(docsPath) //#nosec G304

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c182c6c759f21353 — Filesystem access.
repo/cmd/github-mcp-server/generate_docs.go:128 
	return os.WriteFile(docsPath, []byte(updatedContent), 0600) //#nosec G306

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de98015bb6a5e019 — Filesystem access.
repo/cmd/github-mcp-server/generate_docs.go:458 
	content, err := os.ReadFile(docsPath) //#nosec G304

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef4455ee0d33c87d — Filesystem access.
repo/cmd/github-mcp-server/generate_docs.go:473 
	err = os.WriteFile(docsPath, []byte(updatedContent), 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dca7d4eaf7015159 — Filesystem access.
repo/internal/ghmcp/server.go:280 
		file, err := os.OpenFile(cfg.LogFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5e07b1f06d488190 — Environment-variable access.
repo/internal/oauth/env.go:27 
		if os.Getenv("DISPLAY") == "" && os.Getenv("WAYLAND_DISPLAY") == "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e14f724456236815 — Filesystem access.
repo/internal/oauth/env.go:63 
	if data, err := os.ReadFile("/proc/1/cgroup"); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #739e0984259b99d5 — Environment-variable access.
repo/internal/profiler/profiler.go:176 
	if enabled, err := strconv.ParseBool(os.Getenv("GITHUB_MCP_PROFILING_ENABLED")); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa5744652ede3b63 — Environment-variable access.
repo/internal/toolsnaps/toolsnaps.go:30 
	if os.Getenv("UPDATE_TOOLSNAPS") == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f7f54770b3525a2 — Filesystem access.
repo/internal/toolsnaps/toolsnaps.go:34 
	snapJSON, err := os.ReadFile(snapPath) //nolint:gosec // filepaths are controlled by the test suite, so this is safe.

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13950fcd816c78b2 — Environment-variable access.
repo/internal/toolsnaps/toolsnaps.go:40 
		if os.Getenv("GITHUB_ACTIONS") == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fdd20a139fd4f9eb — Filesystem access.
repo/internal/toolsnaps/toolsnaps.go:84 
	if err := os.WriteFile(snapPath, sortedJSON, 0600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d6798c0a7c8c9f7 — Filesystem access.
repo/pkg/http/server.go:115 
		file, err := os.OpenFile(cfg.LogFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc19e9365cb04f53 — Environment-variable access.
repo/pkg/inventory/instructions.go:11 
	if os.Getenv("DISABLE_INSTRUCTIONS") == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #afb05504ace9664b — Environment-variable access.
repo/pkg/translations/translations.go:42 
			if value, exists := os.LookupEnv("GITHUB_MCP_" + key); exists {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ccf953ca3bcbb6e — Filesystem access.
repo/pkg/translations/translations.go:61 
	file, err := os.Create("github-mcp-server-config.json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

github.com/modelcontextprotocol/go-sdk

go dependency
medium pii_flow tooling Excluded from app score unknown #378155815b66147c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/examples/server/distributed/main.go:97 · flow /tmp/closeopen-ml3d_g_s/pkgs/go/[email protected]/examples/server/distributed/main.go:91 → /tmp/closeopen-ml3d_g_s/pkgs/go/[email protected]/examples/server/distributed/main.go:97 
				log.Printf("child %d failed: %v", i, err)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #d781056f48018767 — Environment-variable access.
pkgs/go/[email protected]/conformance/everything-client/main.go:509 
	scenarioName := os.Getenv("MCP_CONFORMANCE_SCENARIO")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bea6084fcac6d79d — Environment-variable access.
pkgs/go/[email protected]/conformance/everything-client/main.go:528 
	ctxStr := os.Getenv("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #541cf2f16547804f — Environment-variable access.
pkgs/go/[email protected]/examples/server/distributed/main.go:56 
	if v := os.Getenv(childPortVar); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3cc1b847cc4ed72d — Environment-variable access.
pkgs/go/[email protected]/examples/server/distributed/main.go:91 
		cmd.Env = append(os.Environ(), fmt.Sprintf("%s=%s", childPortVar, port))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e0c838a17d920cab — Filesystem access.
pkgs/go/[email protected]/examples/server/memory/kb.go:75 
	data, err := os.ReadFile(fs.path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #16a543937b4c23c1 — Filesystem access.
pkgs/go/[email protected]/examples/server/memory/kb.go:87 
	if err := os.WriteFile(fs.path, data, 0o600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8489c30cb9a7be97 — Environment-variable access.
pkgs/go/[email protected]/internal/mcpgodebug/mcpgodebug.go:26 
	compatibilityParams, err = parseCompatibility(os.Getenv(compatibilityEnvKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/google/go-github/v89

go dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #b7660b01af9b3233 — Environment-variable access.
pkgs/go/[email protected]/github/gen-accessors.go:74 
	return *check || os.Getenv("CHECK") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae66e272cae678db — Filesystem access.
pkgs/go/[email protected]/github/gen-accessors.go:245 
			old, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14f7bb1398edc3fc — Filesystem access.
pkgs/go/[email protected]/github/gen-accessors.go:264 
		if err := os.WriteFile(filename, clean, 0o444); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c001851ca0ffdf4e — Environment-variable access.
pkgs/go/[email protected]/github/gen-iterators.go:50 
	return *check || os.Getenv("CHECK") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88672db741e3a028 — Filesystem access.
pkgs/go/[email protected]/github/gen-iterators.go:639 
			old, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6bbae01463cae232 — Filesystem access.
pkgs/go/[email protected]/github/gen-iterators.go:654 
		return os.WriteFile(filename, clean, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de15a5296ef5705e — Environment-variable access.
pkgs/go/[email protected]/github/gen-stringify-test.go:92 
	return *check || os.Getenv("CHECK") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79a43fc02528e29d — Filesystem access.
pkgs/go/[email protected]/github/gen-stringify-test.go:367 
		old, err := os.ReadFile(t.filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1353eeb55d1a9d9f — Filesystem access.
pkgs/go/[email protected]/github/gen-stringify-test.go:386 
	if err := os.WriteFile(t.filename, clean, 0o444); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/google/jsonschema-go

go dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #f1094daa93cf1b8f — Environment-variable access.
pkgs/go/[email protected]/jsonschema/infer.go:139 
		if os.Getenv(debugEnv) != "typeschemasnull=1" && allowNull {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #025906cba71acc58 — Environment-variable access.
pkgs/go/[email protected]/jsonschema/infer.go:220 
		if os.Getenv(debugEnv) != "typeschemasnull=1" && t.Kind() == reflect.Slice {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d30fbfde6a80a08f — Environment-variable access.
pkgs/go/[email protected]/jsonschema/infer.go:389 
	if os.Getenv(debugEnv) == "typeschemasnull=1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/josephburnett/jd/v2

go dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #a5ad0590b2fa54fe — Filesystem access.
pkgs/go/[email protected]/diff_read.go:12 
	bytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d91249b6ac28a15 — Filesystem access.
pkgs/go/[email protected]/diff_read.go:243 
	bytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #199b1cee7f458e2f — Filesystem access.
pkgs/go/[email protected]/diff_read.go:488 
	bytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4934ccfbcc75c093 — Filesystem access.
pkgs/go/[email protected]/internal/coverfilter/main.go:31 
	f, err := os.Open(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e8b1a9bd23dc4c8 — Filesystem access.
pkgs/go/[email protected]/internal/coverfilter/main.go:65 
	data, err := os.ReadFile("go.mod")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53235ad29d1aab4a — Filesystem access.
pkgs/go/[email protected]/internal/coverfilter/main.go:84 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6af9dd1b1911ba5 — Filesystem access.
pkgs/go/[email protected]/internal/web/pack/main.go:22 
		b, err := os.ReadFile(fmt.Sprintf("internal/web/assets/%v", f))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68dd8d1149015eef — Filesystem access.
pkgs/go/[email protected]/internal/web/pack/main.go:30 
	err := os.WriteFile("internal/web/serve/files.go", []byte(pack), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5ef82de2ac2cf29 — Filesystem access.
pkgs/go/[email protected]/jd/main.go:245 
		os.WriteFile(*output, []byte(str), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c771f06e5cc0da39 — Filesystem access.
pkgs/go/[email protected]/jd/main.go:367 
		os.WriteFile(*output, []byte(out), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fb7bb93d610d546 — Filesystem access.
pkgs/go/[email protected]/jd/main.go:423 
		os.WriteFile(*output, []byte(out), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5077d9858173699d — Filesystem access.
pkgs/go/[email protected]/jd/main.go:438 
	bytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24b4baf2615bcd3b — Environment-variable access.
pkgs/go/[email protected]/jd/main.go:457 
	gitHubOutput := os.Getenv("GITHUB_OUTPUT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c48e6b5f07b45d9 — Filesystem access.
pkgs/go/[email protected]/jd/main.go:461 
	file, err := os.OpenFile(gitHubOutput, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bd600f81d869814 — Filesystem access.
pkgs/go/[email protected]/node_read.go:13 
	bytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5651ee4525890aa — Filesystem access.
pkgs/go/[email protected]/node_read.go:22 
	bytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/shurcooL/githubv4

go dependency
expand_more 4 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #9b5ca3d4aad44903 — Environment-variable access.
pkgs/go/[email protected]/example/githubv4dev/main.go:32 
		&oauth2.Token{AccessToken: os.Getenv("GITHUB_GRAPHQL_TEST_TOKEN")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84597422a7129c9f — Environment-variable access.
pkgs/go/[email protected]/gen.go:33 
	githubToken, ok := os.LookupEnv("GITHUB_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd44d118a5a31e65 — Filesystem access.
pkgs/go/[email protected]/gen.go:54 
		err = os.WriteFile(filename, out, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c8a02af7f01d9217 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/go/[email protected]/gen.go:64 
	req, err := http.NewRequest("GET", "https://api.github.com/graphql", nil)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

github.com/spf13/cobra

go dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #7de3a0bfcfabb2d8 — Environment-variable access.
pkgs/go/[email protected]/active_help.go:48 
	activeHelpCfg := os.Getenv(activeHelpGlobalEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #225a04238e25957c — Environment-variable access.
pkgs/go/[email protected]/active_help.go:50 
		activeHelpCfg = os.Getenv(activeHelpEnvVar(cmd.Root().Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4c1d23d59d36b01 — Filesystem access.
pkgs/go/[email protected]/bash_completions.go:702 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4677caeb465c684 — Filesystem access.
pkgs/go/[email protected]/bash_completionsV2.go:471 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93f64382a7fdd6e2 — Environment-variable access.
pkgs/go/[email protected]/completions.go:957 
	if path := os.Getenv("BASH_COMP_DEBUG_FILE"); path != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad3992d0811623ab — Filesystem access.
pkgs/go/[email protected]/completions.go:958 
		f, err := os.OpenFile(path,
			os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f58acf8e5187fc7 — Environment-variable access.
pkgs/go/[email protected]/completions.go:1015 
	v := os.Getenv(configEnvVar(cmd.Root().Name(), suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f30b97698ec0dc74 — Environment-variable access.
pkgs/go/[email protected]/completions.go:1017 
		v = os.Getenv(configEnvVar(configEnvVarGlobalPrefix, suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f078925b19b7bea — Filesystem access.
pkgs/go/[email protected]/doc/man_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f00176fd04faf13f — Environment-variable access.
pkgs/go/[email protected]/doc/man_docs.go:127 
		if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fe2d296b8422be8 — Filesystem access.
pkgs/go/[email protected]/doc/md_docs.go:145 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a65d39a488b2f241 — Filesystem access.
pkgs/go/[email protected]/doc/rest_docs.go:157 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ab10932c32c5eaf — Filesystem access.
pkgs/go/[email protected]/doc/yaml_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d57dcc7ac0aed027 — Filesystem access.
pkgs/go/[email protected]/fish_completions.go:285 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fa17732cf131aac — Filesystem access.
pkgs/go/[email protected]/powershell_completions.go:321 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7aa6770ad0929bb — Filesystem access.
pkgs/go/[email protected]/zsh_completions.go:71 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/spf13/viper

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #4b82d2798d2e4499 — Environment-variable access.
pkgs/go/[email protected]/util.go:133 
		home := os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ee52cf29458d45b — Environment-variable access.
pkgs/go/[email protected]/util.go:135 
			home = os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #017415c9bc4a1478 — Environment-variable access.
pkgs/go/[email protected]/util.go:139 
	return os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b703f97f674b7b45 — Environment-variable access.
pkgs/go/[email protected]/viper.go:447 
	val, ok := os.LookupEnv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/oauth2

go dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #80a2752751342373 — Environment-variable access.
pkgs/go/[email protected]/google/default.go:237 
	if filename := os.Getenv(envVar); filename != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04d8c42e34385e04 — Filesystem access.
pkgs/go/[email protected]/google/default.go:247 
	if b, err := os.ReadFile(filename); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3861cbc9075e15ea — Environment-variable access.
pkgs/go/[email protected]/google/default.go:429 
		return filepath.Join(os.Getenv("APPDATA"), "gcloud", f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f11926fc81c24049 — Filesystem access.
pkgs/go/[email protected]/google/default.go:435 
	b, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fed05df785a073a — Environment-variable access.
pkgs/go/[email protected]/google/externalaccount/executablecredsource.go:98 
	return os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06c62bb44e79da7c — Environment-variable access.
pkgs/go/[email protected]/google/externalaccount/executablecredsource.go:102 
	return os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14f8cc736150ad75 — Filesystem access.
pkgs/go/[email protected]/google/externalaccount/executablecredsource.go:253 
	file, err := os.Open(cs.OutputFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3bca29ce386ac97 — Filesystem access.
pkgs/go/[email protected]/google/externalaccount/filecredsource.go:26 
	tokenFile, err := os.Open(cs.File)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #693a4d1d20afbc65 — Filesystem access.
pkgs/go/[email protected]/google/sdk.go:60 
	f, err := os.Open(credentialsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c945caf8456ccfa — Filesystem access.
pkgs/go/[email protected]/google/sdk.go:75 
		f, err := os.Open(propertiesPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60d36acb60271444 — Environment-variable access.
pkgs/go/[email protected]/google/sdk.go:182 
		return filepath.Join(os.Getenv("APPDATA"), "gcloud"), nil

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d8764d2bf5ff781 — Environment-variable access.
pkgs/go/[email protected]/google/sdk.go:193 
	if v := os.Getenv("HOME"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.