Close Open Privacy Scan

link https://github.com/mem0ai/mem0
bolt Snapshot: commit 726bcc8
science engine v1.22
schedule 2026-07-20T09:00:22.662130+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

smart_toy AI deps detected: @ai-sdk/anthropic, @ai-sdk/openai, @anthropic-ai/sdk, @langchain/core +11 more — detected in dependencies, not a safety judgment.

App Privacy Score

57 /100
Medium privacy risk

Medium risk · 1460 finding(s)

Dependency score: 0 (High risk)

bar_chart Score Breakdown

telemetry −25
egress −15
env_fs −3

list Scan Summary

0 high 345 medium 1115 low
First-party packages: 4
Dependency packages: 25
Ecosystem: python

swap_horiz Application data flows

External domains: ::ffff:192.168.0.1abcsales.cloud.databricks.comai-sdk.devai.google.devaiplatform.googleapis.comaka.msalembic.sqlalchemy.organimations.devapi-docs.databricks.comapi-inference.huggingface.coapi.anthropic.comapi.cloudflare.comapi.cohere.comapi.deepseek.comapi.github.comapi.groq.comapi.jina.aiapi.mem0.aiapi.minimax.ioapi.morphllm.comapi.openai.comapi.pinecone.ioapi.sarvam.aiapi.together.aiapi.together.xyzapi.x.aiapp.mem0.aiapp.posthog.comarrow.apache.orgarticles-en-preview-xyz.pinecone.ioarticles-en-preview.svc.pinecone.ioarxiv.orgauth.openai.comautopush-generativelanguage.sandbox.googleapis.comavro.apache.orgaws.amazon.combce.baidu.combrotlipy.readthedocs.iobugs.python.orgcassandra.apache.orgchroma-onnx-models.s3.amazonaws.comcircumicons.comcloud.google.comcode.activestate.comcode.google.comcognitiveservices.azure.comconsole.groq.comconsole.pinecone.iocookbook.openai.comcreativecommons.orgcustom.api.mem0.aicvs.pgfoundry.orgcx-oracle.readthedocs.iodatabase.windows.netdatastax-oss.atlassian.netdatatracker.ietf.orgdate-fns.orgdev.mysql.comdeveloper.mozilla.orgdevelopers.cloudflare.comdevelopers.google.comdiscord.ggdiscuss.python.orgdochub.mongodb.orgdocs.anthropic.comdocs.atlas.mongodb.comdocs.aws.amazon.comdocs.cloud.google.comdocs.cohere.comdocs.databricks.comdocs.datastax.comdocs.expo.devdocs.gcp.databricks.comdocs.mem0.aidocs.microsoft.comdocs.nomic.aidocs.oracle.comdocs.pinecone.iodocs.pydantic.devdocs.python-requests.orgdocs.python.orgdocs.rsdocs.together.aidocs.trychroma.comdocs.weaviate.iodownload.oracle.comdownload.pytorch.orgdummy.comeli.thegreenplace.netembed.trychroma.comen.wikipedia.orgerikflowers.github.ioerrors.pydantic.deveu.i.posthog.comeu.posthog.comexam_ple.comexample-resource.azure.openai.comfeathericons.comfontawesome.comfoo.comgame-icons.netgateway.ai.cloudflare.comgemini-api-demos.uc.r.appspot.comgenerativelanguage.googleapis.comgist.github.comgit-scm.comgithub.comgoogle-auth.readthedocs.iogoogle.aip.devgoogle.github.iogrpc.github.iohelp.openai.comhost.docker.internalhttpbin.orghypothesis.readthedocs.ioicons.radix-ui.comicons8.comidp.mycompany.cominfer.roboflow.cominference.do-ai.runionicons.comissues.apache.orgjina.aijson-schema.orgkafka.apache.orgkb.databricks.comlearn.microsoft.comlegacy.python.orglinux.die.netlogin.chinacloudapi.cnlogin.microsoft.comlogin.microsoftonline.comlogin.microsoftonline.uslogin.pinecone.iolucene.apache.orglucide.devmagicstack.github.iomanagement.azure.commanagement.chinacloudapi.cnmanagement.core.chinacloudapi.cnmanagement.core.usgovcloudapi.netmanagement.core.windows.netmanagement.usgovcloudapi.netmaven.apache.orgmem0.aimodel-spec.openai.commodelcontextprotocol.iomongodb.commsdn.microsoft.commy-index.svc.pinecone.iomy-keyvault-name.vault.azure.netmy-workspace.cloud.databricks.commypy.readthedocs.iomüller.denats.ionews.google.comnpm.imnpms.ionumpy.orgocticons.github.comollama.comonnxruntime.aiontheline.trincoll.eduopenai.comopenrouter.aiopensource.orgoracle.github.iooss.valkey.comossrdbms-aad.database.windows.netother.compackaging.python.orgpeps.python.orgpiblpmmdsiknacjnm1ltla.c1.europe-west3.gcp.weaviate.cloudpip.pypa.ioplatform.claude.complatform.openai.composthog.comprod-1-data.ke.pinecone.ioprotobuf.devpydantic-docs.helpmanual.iopymysql.readthedocs.iopypi.orgpypi.python.orgpypika.readthedocs.iopython-devtools.helpmanual.iopython-oracledb.readthedocs.iopythonhosted.orgraw.githubusercontent.comreact.devreactjs.orgredis.azure.comredis.comredis.ioredux-toolkit.js.orgredux.js.orgregistry.terraform.iorich.readthedocs.ios-ings.coms3-us-west-2.amazonaws.comsass-lang.comscripts.sil.orgsearch.azure.comsimpleicons.orgsome-cohere-baseurl.aisome-url.comsonner.emilkowal.skisourceforge.netspark.apache.orgsqlalche.mesqlite.orgsrc.dev.databricks.comstackoverflow.comstatus.databricks.comstorage-proxy.databricks.comstorage.googleapis.comtartarus.orgtechnet.microsoft.comtechspot.zzzeek.orgthesabbir.github.iotimeapi.iotoken.actions.githubusercontent.comtools.ietf.orgtwistedmatrix.comtwitter.comus.i.posthog.comus.posthog.comvalkey-py-cluster.readthedocs.iovalkey-py.readthedocs.iovalkey.comvalkey.iovorillaz.github.ioweaviate.iowebsockets.readthedocs.iowebwareforpython.github.iowiki.centos.orgwww.allrecipes.comwww.apache.orgwww.databricks.comwww.datastax.comwww.example.珠宝www.foodnetwork.comwww.framer.comwww.freetds.orgwww.gevent.orgwww.github.comwww.googleapis.comwww.ietf.orgwww.microsoft.comwww.mlflow.orgwww.mongodb.comwww.oracle.comwww.pcre.orgwww.postgresql.orgwww.psycopg.orgwww.pygresql.orgwww.python-httpx.orgwww.python.orgwww.quartz-scheduler.orgwww.rfc-editor.orgwww.sqlite.orgwww.w3.orgwww.w3schools.comwww.weaviate.iowww.xudongz.comwww.zetetic.netxn--fiqs8s.icom.museumyour-app.com

medium first-party (python) A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/client/main.py:116 → repo/mem0/client/main.py:141
medium first-party (python) A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/client/main.py:1005 → repo/mem0/client/main.py:1030
medium first-party (python) A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/client/main.py:1057 → repo/mem0/client/main.py:1056
medium first-party (python) A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/llms/sarvam.py:47 → repo/mem0/llms/sarvam.py:81
medium first-party (python): cli/python A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/cli/python/src/mem0_cli/backend/platform.py:28 → repo/cli/python/src/mem0_cli/backend/platform.py:27
hub Dependency data flows (106)
medium azure-identity dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:66 → pkgs/python/[email protected]/azure/identity/_credentials/environment.py:99
medium azure-identity dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:60 → pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:77
medium databricks-sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:340 → pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:343
medium databricks-sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:21 → pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:23
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:70
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:127
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:73
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:134
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication.py:32 → pkgs/python/[email protected]/samples/sample_authentication.py:39
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication.py:48 → pkgs/python/[email protected]/samples/sample_authentication.py:55
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication_async.py:33 → pkgs/python/[email protected]/samples/sample_authentication_async.py:41
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication_async.py:50 → pkgs/python/[email protected]/samples/sample_authentication_async.py:58
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:59
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:72
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:87
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:100
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:115
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:61
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:77
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:93
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:107
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:123
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → pkgs/python/[email protected]/samples/sample_index_alias_crud.py:42
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → pkgs/python/[email protected]/samples/sample_index_alias_crud.py:54
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → pkgs/python/[email protected]/samples/sample_index_alias_crud.py:108
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:44
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:57
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:112
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:26 → pkgs/python/[email protected]/samples/sample_index_analyze_text.py:43
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:27 → pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:45
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:33 → pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:46
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:37 → pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:51
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:69
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:80
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:126
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:139
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_index_crud_async.py:72
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_index_crud_async.py:84
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_index_crud_async.py:132
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:43
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:59
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:71
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:85
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:45
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:62
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:75
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:90
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:74
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:87
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:99
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:112
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:80
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:94
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:107
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:121
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:51
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:64
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:76
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:52
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:66
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:79
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → pkgs/python/[email protected]/samples/sample_indexer_workflow.py:119
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → pkgs/python/[email protected]/samples/sample_indexer_workflow.py:130
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → pkgs/python/[email protected]/samples/sample_indexer_workflow.py:134
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:26 → pkgs/python/[email protected]/samples/sample_query_autocomplete.py:40
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:28 → pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:43
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_facets.py:26 → pkgs/python/[email protected]/samples/sample_query_facets.py:43
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:28 → pkgs/python/[email protected]/samples/sample_query_facets_async.py:46
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_filter.py:26 → pkgs/python/[email protected]/samples/sample_query_filter.py:45
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:28 → pkgs/python/[email protected]/samples/sample_query_filter_async.py:48
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:66
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:67
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:89
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:90
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:69
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:70
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:91
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:92
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_session.py:24 → pkgs/python/[email protected]/samples/sample_query_session.py:38
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_session_async.py:25 → pkgs/python/[email protected]/samples/sample_query_session_async.py:40
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_simple.py:24 → pkgs/python/[email protected]/samples/sample_query_simple.py:38
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:26 → pkgs/python/[email protected]/samples/sample_query_simple_async.py:41
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:24 → pkgs/python/[email protected]/samples/sample_query_suggestions.py:39
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:26 → pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:42
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:130
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:148
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:170
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:196
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:221
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:222
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:223
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:224
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:225
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:226
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:134
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:153
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:176
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:204
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:230
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:231
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:232
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:233
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:234
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:235
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:25 → pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:42
medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:26 → pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:48

</> First-Party Code

first-party (python)

python first-party
medium pii_flow production #9fac2ea0e2f1d357 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/client/main.py:141 · flow /tmp/closeopen-wiuwd3vh/repo/mem0/client/main.py:116 → /tmp/closeopen-wiuwd3vh/repo/mem0/client/main.py:141 
                headers={
                    "Authorization": f"Token {self.api_key}",
                    "Mem0-User-ID": self.user_id,
                },

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow production #f118f02cb3ea2e6a — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/client/main.py:1030 · flow /tmp/closeopen-wiuwd3vh/repo/mem0/client/main.py:1005 → /tmp/closeopen-wiuwd3vh/repo/mem0/client/main.py:1030 
                headers={
                    "Authorization": f"Token {self.api_key}",
                    "Mem0-User-ID": self.user_id,
                },

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow production #269c5811a48564eb — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/client/main.py:1056 · flow /tmp/closeopen-wiuwd3vh/repo/mem0/client/main.py:1057 → /tmp/closeopen-wiuwd3vh/repo/mem0/client/main.py:1056 
                headers={
                    "Authorization": f"Token {self.api_key}",
                    "Mem0-User-ID": self.user_id,
                },

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow production #6aaa4bcf164f34fb — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/mem0/llms/sarvam.py:81 · flow /tmp/closeopen-wiuwd3vh/repo/mem0/llms/sarvam.py:47 → /tmp/closeopen-wiuwd3vh/repo/mem0/llms/sarvam.py:81 
            response = requests.post(url, headers=headers, json=params, timeout=30)

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium telemetry production #4c6f39254d22ca94 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/server/telemetry.py:66 
        from posthog import Posthog

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 278 low-confidence finding(s)
low env_fs test-only Excluded from app score #143d34f8ffd52da2 — Environment-variable access.
repo/examples/misc/movie_recommendation_grok3.py:41 
    api_key=os.getenv("XAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4e510f7bcd87db49 — Filesystem access.
repo/examples/misc/personal_assistant_agno.py:34 
        with open(image_path, "rb") as image_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2d4f35a1a923dcd5 — Environment-variable access.
repo/examples/misc/strands_agent_aws_elasticache_neptune.py:71 
                "valkey_url": os.getenv("VALKEY_URL", "valkey://localhost:6379"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cba25e0c4393e2bc — Environment-variable access.
repo/examples/misc/strands_agent_aws_elasticache_neptune.py:82 
            "endpoint": os.getenv("NEPTUNE_ENDPOINT", "neptune-graph://g-6n3v83av7a"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e534976f8dbbef7c — Filesystem access.
repo/examples/misc/voice_assistant_elevenlabs.py:149 
        with open(audio_path, "rb") as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #675a1fa5fbc3e52c — Filesystem access.
repo/integrations/mem0-plugin/scripts/_identity.py:41 
            for line in path.read_text(encoding="utf-8", errors="replace").splitlines():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #efdca4f227c9284f — Environment-variable access.
repo/integrations/mem0-plugin/scripts/_identity.py:56 
    key = os.environ.get("MEM0_API_KEY", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #748a08986a772cb9 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/_identity.py:59 
    key = os.environ.get("CLAUDE_PLUGIN_OPTION_API_KEY", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ea0db44e9e7aea2a — Environment-variable access.
repo/integrations/mem0-plugin/scripts/_identity.py:62 
    key = os.environ.get("CLAUDE_PLUGIN_OPTION_MEM0_API_KEY", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d1b659b427fbc0cb — Environment-variable access.
repo/integrations/mem0-plugin/scripts/_identity.py:72 
    explicit = os.environ.get("MEM0_USER_ID", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a787352b78feb8fa — Environment-variable access.
repo/integrations/mem0-plugin/scripts/_identity.py:75 
    return os.environ.get("USER") or "default"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #69d43ae670c3f84b — Environment-variable access.
repo/integrations/mem0-plugin/scripts/_project.py:26 
    explicit = os.environ.get("MEM0_PROJECT_ID", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dc9ea70dd2461692 — Filesystem access.
repo/integrations/mem0-plugin/scripts/_project.py:34 
            with open(map_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6b76cea77a4fbf49 — Filesystem access.
repo/integrations/mem0-plugin/scripts/_project.py:47 
                        with open(map_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #de2cc6ec70ea8d6c — Filesystem access.
repo/integrations/mem0-plugin/scripts/_project.py:101 
            with open(map_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a0ae897f8017f092 — Filesystem access.
repo/integrations/mem0-plugin/scripts/_project.py:110 
    with open(map_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #11e25da8eaf9f340 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/_search.py:29 
    raw = os.environ.get("MEM0_RERANK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #3a86df70897d6d42 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/_search.py:37 
    req = urllib.request.Request(
        SEARCH_URL,
        data=body,
        headers={"Authorization": f"Token {api_key}", "Content-Type": "application/json"},
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #6e19fee8f363514d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/_search.py:43 
    with urllib.request.urlopen(req, timeout=SEARCH_TIMEOUT) as r:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #487ce80bba5e295b — Environment-variable access.
repo/integrations/mem0-plugin/scripts/auto_capture.py:32 
if os.environ.get("MEM0_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #514ea15e6dca1bbc — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_capture.py:50 
        with open(filepath, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #4a4d20714471fbb6 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_capture.py:131 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/add/",
        data=data,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Token {api_key}",
        },
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #55c621dce4131336 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_capture.py:141 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #5e7d276143383e09 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/auto_capture.py:173 
    sid_file = f"/tmp/mem0_session_id_{os.environ.get('USER', 'default')}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #372cc722c3244673 — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_capture.py:176 
            with open(sid_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3e8731e8704f2e5e — Environment-variable access.
repo/integrations/mem0-plugin/scripts/auto_import.py:34 
if os.environ.get("MEM0_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8ab92cf316101d17 — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_import.py:96 
    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #599ab3f0f94a87ce — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_import.py:107 
        with open(HASH_STORE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #49ecdbd10c829141 — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_import.py:118 
        with open(HASH_STORE, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #3984df5a79b6cab7 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_import.py:137 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/search/",
        data=body,
        headers={"Content-Type": "application/json", "Authorization": f"Token {api_key}"},
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #f46811347c3e962c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_import.py:144 
        with urllib.request.urlopen(req, timeout=5) as r:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #5fc15cb71af86ab8 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_import.py:171 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/search/",
        data=body,
        headers={"Content-Type": "application/json", "Authorization": f"Token {api_key}"},
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #f00f01aeeccb929d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_import.py:179 
        with urllib.request.urlopen(req, timeout=10) as r:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #0eabe2a5a9ed07c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_import.py:203 
            with urllib.request.urlopen(del_req, timeout=10):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #67b3c4cdc9dc48a7 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_import.py:236 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/add/",
        data=data,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Token {api_key}",
        },
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #2319113146f96c80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/auto_import.py:247 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #294237b4e266d23a — Environment-variable access.
repo/integrations/mem0-plugin/scripts/auto_import.py:264 
    cwd = os.environ.get("MEM0_CWD", "").strip() or os.getcwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d4b164991900d0a0 — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_import.py:331 
            with open(filepath, encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c5c568f3369ad186 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/auto_setup_categories.py:50 
if os.environ.get("MEM0_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eae00b4a109119d9 — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_setup_categories.py:96 
        with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #50126168a8066867 — Filesystem access.
repo/integrations/mem0-plugin/scripts/auto_setup_categories.py:113 
        with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #541c1c4be917d692 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/auto_setup_categories.py:200 
    os.environ["MEM0_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8ce6758456d9cd70 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/capture_compact_summary.py:37 
if os.environ.get("MEM0_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a14309846cfe0cf1 — Filesystem access.
repo/integrations/mem0-plugin/scripts/capture_compact_summary.py:56 
        with open(filepath, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #80ea191a416c8589 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/capture_compact_summary.py:120 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/add/",
        data=data,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Token {api_key}",
        },
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #fe12567491fde62b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/capture_compact_summary.py:130 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #83dc9d929d48a64a — Filesystem access.
repo/integrations/mem0-plugin/scripts/capture_compact_summary.py:189 
                with open(marker_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #575e0d1f8ff5e3fd — Environment-variable access.
repo/integrations/mem0-plugin/scripts/capture_session_summary.py:35 
if os.environ.get("MEM0_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7e71cc7f89f5b120 — Filesystem access.
repo/integrations/mem0-plugin/scripts/capture_session_summary.py:60 
        with open(filepath, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #c007c09d2e1c1c1b — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/capture_session_summary.py:193 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/add/",
        data=data,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Token {api_key}",
        },
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #29fa74bebaead7e1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/capture_session_summary.py:203 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #f5a957a744d57e2c — Environment-variable access.
repo/integrations/mem0-plugin/scripts/file_context.py:87 
    global_search = os.environ.get("MEM0_GLOBAL_SEARCH", "false") == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6187e45759c32f08 — Filesystem access.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:44 
        with open(HASH_STORE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8b233c5aa6cf7437 — Filesystem access.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:53 
        with open(HASH_STORE, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #48f5712709879981 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:85 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/add/",
        data=data,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Token {api_key}",
        },
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #0f5e4b066e533c01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:95 
        with urllib.request.urlopen(req, timeout=20) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #2ed1917e7365b475 — Filesystem access.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:161 
    with open(path, encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ec6d43ab8d88e61d — Filesystem access.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:191 
    with open(path, encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0829beb17d3a4154 — Filesystem access.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:230 
        with open(filepath, encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c685f8b2c0a2f73d — Filesystem access.
repo/integrations/mem0-plugin/scripts/import_competing_tools.py:258 
    with open(path, encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6ae6a461a426636a — Filesystem access.
repo/integrations/mem0-plugin/scripts/install_codex_hooks.py:47 
    raw = TEMPLATE_FILE.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #27b8e7df9f9adc4f — Filesystem access.
repo/integrations/mem0-plugin/scripts/install_codex_hooks.py:56 
        return json.loads(HOOKS_FILE.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9f7c05308468d368 — Filesystem access.
repo/integrations/mem0-plugin/scripts/install_codex_hooks.py:88 
    HOOKS_FILE.write_text(json.dumps(config, indent=2) + "\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2014fd95d0426fa8 — Filesystem access.
repo/integrations/mem0-plugin/scripts/install_codex_hooks.py:94 
    content = CONFIG_FILE.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a554aec41d12607 — Filesystem access.
repo/integrations/mem0-plugin/scripts/load_settings.py:28 
            with open(SETTINGS_PATH) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #52dfaa33a084ea22 — Filesystem access.
repo/integrations/mem0-plugin/scripts/load_settings.py:39 
        with open(SETTINGS_PATH, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4853d2e08364d0b6 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/on_pre_compact.py:35 
if os.environ.get("MEM0_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8bcd1e6cc30d7194 — Filesystem access.
repo/integrations/mem0-plugin/scripts/on_pre_compact.py:59 
        with open(filepath, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #65b4b3e38f42c6e8 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/on_pre_compact.py:183 
    req = urllib.request.Request(
        f"{API_URL}/v3/memories/add/",
        data=data,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Token {api_key}",
        },
        method="POST",
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #5531c56298ede115 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/on_pre_compact.py:194 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #1df8300a6f8ec94d — Environment-variable access.
repo/integrations/mem0-plugin/scripts/on_pre_compact.py:277 
    stats_file = f"/tmp/mem0_session_stats_{os.environ.get('USER', 'default')}.json"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d31a39b0659ac6f9 — Filesystem access.
repo/integrations/mem0-plugin/scripts/on_pre_compact.py:279 
        with open(stats_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cb43bc7092b92b39 — Filesystem access.
repo/integrations/mem0-plugin/scripts/parse_export_file.py:137 
            with open(filepath, encoding="utf-8", errors="replace") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3d80e4cfffd86ef2 — Filesystem access.
repo/integrations/mem0-plugin/scripts/parse_mem0_config.py:172 
        with open(config_path, encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #168414b295238ea6 — Filesystem access.
repo/integrations/mem0-plugin/scripts/parse_mem0_config.py:223 
        with open(config_path, encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3339f1a84ead740f — Environment-variable access.
repo/integrations/mem0-plugin/scripts/session_stats.py:21 
STATS_FILE = f"/tmp/mem0_session_stats_{os.environ.get('USER', 'default')}.json"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #27cee0328a6f8279 — Filesystem access.
repo/integrations/mem0-plugin/scripts/session_stats.py:27 
            with open(STATS_FILE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bde25f58a94c4f1a — Filesystem access.
repo/integrations/mem0-plugin/scripts/session_stats.py:41 
    with open(STATS_FILE, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2eb1b07fa05499f7 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/session_timeline.py:32 
    global_search = os.environ.get("MEM0_GLOBAL_SEARCH", "false") == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #97cfb4022884fd27 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/session_timeline.py:50 
        with urllib.request.urlopen(req, timeout=FETCH_TIMEOUT) as r:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #cc51040fe2c0d695 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/session_timeline.py:90 
    project_id = resolve_project_id(os.environ.get("MEM0_CWD"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ea0e7ef2c2e60a7a — Environment-variable access.
repo/integrations/mem0-plugin/scripts/setup_coding_categories.py:29 
_plugin_root = os.environ.get("CLAUDE_PLUGIN_ROOT", os.path.join(_script_dir, ".."))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fd5cfd201887b459 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/setup_coding_categories.py:30 
_data_dir = os.environ.get("CLAUDE_PLUGIN_DATA", os.path.join(os.path.expanduser("~"), ".mem0", "plugin-data"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b44987dc86d1b847 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/setup_coding_categories.py:182 
    os.environ["MEM0_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7b92c0813f00e650 — Filesystem access.
repo/integrations/mem0-plugin/scripts/telemetry.py:45 
        with open(plugin_json) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4a5bfe6cd99a6538 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:64 
    api_key = os.environ.get("MEM0_API_KEY") or os.environ.get("CLAUDE_PLUGIN_OPTION_MEM0_API_KEY") or ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #003f8b036d6bee49 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:67 
    user_id = os.environ.get("MEM0_RESOLVED_USER_ID") or os.environ.get("USER") or "unknown"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ed67297e389d9b72 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:72 
    explicit = os.environ.get("MEM0_PLATFORM")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #38458924395a701f — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:75 
    if os.environ.get("ANTIGRAVITY_PLUGIN_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7d408f6682d4943c — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:77 
    if os.environ.get("PLUGIN_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #99b6d5dd4cc69a9d — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:79 
    if os.environ.get("CLAUDECODE") or os.environ.get("CLAUDE_PLUGIN_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ee0df780bf998e4a — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:81 
    if os.environ.get("CURSOR_PLUGIN_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #91d44b5f57532852 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:83 
    if os.environ.get("WINDSURF_PLUGIN_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2def86e788ba36d4 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:89 
    return os.environ.get("MEM0_TELEMETRY", "true").lower() not in ("false", "0", "no", "off")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7401e46460c3ed89 — Environment-variable access.
repo/integrations/mem0-plugin/scripts/telemetry.py:93 
    project_id = os.environ.get("MEM0_PROJECT_ID") or "unknown"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #e63e785dbd261341 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/telemetry.py:116 
    req = urllib.request.Request(
        POSTHOG_HOST,
        data=data,
        headers={"Content-Type": "application/json"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #47d2746a61adab11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/scripts/telemetry.py:122 
        with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #9974f8a6676e0cbb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/integrations/mem0-plugin/skills/mem0/scripts/mem0_doc_search.py:83 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #0a628a3740262944 — Environment-variable access.
repo/mem0/client/main.py:116 
        self.api_key = api_key or os.getenv("MEM0_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #9d0ce2417f32efa7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:243 
        response = self.client.get(f"/v1/memories/{_encode_path_segment(memory_id)}/", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #faa90ec64e972394 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:381 
        response = self.client.put(f"/v1/memories/{_encode_path_segment(memory_id)}/", json=payload, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #80cd584916d97123 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:466 
        response = self.client.get(f"/v1/memories/{_encode_path_segment(memory_id)}/history/", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8a5cb79461c32a38 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:716 
        response = self.client.get(
            f"/api/v1/orgs/organizations/{self.org_id}/projects/{self.project_id}/",
            params=params,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1ed071720465b071 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:824 
        response = self.client.get(f"api/v1/webhooks/projects/{project_id}/")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6b91b36fa317986c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:852 
        response = self.client.post(f"api/v1/webhooks/projects/{project_id}/", json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f3d1e463a9273b55 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:886 
        response = self.client.put(f"api/v1/webhooks/{webhook_id}/", json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #e3a2c1809aefc864 — Environment-variable access.
repo/mem0/client/main.py:1005 
        self.api_key = api_key or os.getenv("MEM0_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #ceebb2a595ced160 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1054 
            response = requests.get(
                f"{self.host}/v1/ping/",
                headers={
                    "Authorization": f"Token {self.api_key}",
                    "Mem0-User-ID": self.user_id,
                },
                params=params,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #99a93ed9a2cef159 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1163 
        response = await self.async_client.get(f"/v1/memories/{_encode_path_segment(memory_id)}/", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #53c59cd8d31228ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1301 
        response = await self.async_client.put(
            f"/v1/memories/{_encode_path_segment(memory_id)}/", json=payload, params=params
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #016eeed5e04dc674 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1383 
        response = await self.async_client.get(
            f"/v1/memories/{_encode_path_segment(memory_id)}/history/",
            params=params,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c7e3a290a1e6c9fa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1622 
        response = await self.async_client.get(
            f"/api/v1/orgs/organizations/{self.org_id}/projects/{self.project_id}/",
            params=params,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #75375636958b2ca9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1726 
        response = await self.async_client.get(f"api/v1/webhooks/projects/{project_id}/")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f6ad6c9b12b1d009 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1754 
        response = await self.async_client.post(f"api/v1/webhooks/projects/{project_id}/", json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #93f5afa2cf5cef34 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/main.py:1788 
        response = await self.async_client.put(f"api/v1/webhooks/{webhook_id}/", json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3cb5aab727573a31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:342 
        response = self._client.get(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/",
            params=params,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f34e63e4b1eda055 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:380 
        response = self._client.post(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/",
            json=payload,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cbe7d4d9b5a77db2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:494 
        response = self._client.get(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/members/",
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d053071a9b855e74 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:529 
        response = self._client.post(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/members/",
            json=payload,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6e3b77cfd154c3c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:565 
        response = self._client.put(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/members/",
            json=payload,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a5fa97f81050f682 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:655 
        response = await self._client.get(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/",
            params=params,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8f7cadf6f60d9848 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:693 
        response = await self._client.post(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/",
            json=payload,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b1be078e3ab67082 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:807 
        response = await self._client.get(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/members/",
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5897d6bd08e353c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:842 
        response = await self._client.post(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/members/",
            json=payload,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2503ae367a39c0e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/client/project.py:878 
        response = await self._client.put(
            f"/api/v1/orgs/organizations/{self.config.org_id}/projects/{self.config.project_id}/members/",
            json=payload,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #0283a698de34d4d1 — Environment-variable access.
repo/mem0/configs/base.py:13 
mem0_dir = os.environ.get("MEM0_DIR") or os.path.join(home_dir, ".mem0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #219220b5046d1168 — Environment-variable access.
repo/mem0/configs/embeddings/base.py:111 
        self.aws_region = aws_region or os.environ.get("AWS_REGION") or "us-west-2"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #263b47a58329d56b — Environment-variable access.
repo/mem0/configs/llms/aws_bedrock.py:58 
        self.aws_region = aws_region or os.getenv("AWS_REGION", "us-west-2")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #70994545342b8b5e — Environment-variable access.
repo/mem0/configs/llms/aws_bedrock.py:101 
            config["aws_access_key_id"] = self.aws_access_key_id or os.getenv("AWS_ACCESS_KEY_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fa6d052b99780765 — Environment-variable access.
repo/mem0/configs/llms/aws_bedrock.py:104 
            config["aws_secret_access_key"] = self.aws_secret_access_key or os.getenv("AWS_SECRET_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5442d91161c4633e — Environment-variable access.
repo/mem0/configs/llms/aws_bedrock.py:107 
            config["aws_session_token"] = self.aws_session_token or os.getenv("AWS_SESSION_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6ed59d19a609de97 — Environment-variable access.
repo/mem0/configs/llms/aws_bedrock.py:110 
            config["profile_name"] = self.aws_profile or os.getenv("AWS_PROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da2b2db1c1858bdb — Environment-variable access.
repo/mem0/configs/llms/gemini.py:61 
            vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() in ("true", "1", "yes")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83246935a34c36f3 — Environment-variable access.
repo/mem0/configs/llms/gemini.py:63 
        self.project = project or os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19e6bdfa4e3f9fd8 — Environment-variable access.
repo/mem0/configs/llms/gemini.py:64 
        self.location = location or os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4349e8d7500cc4fd — Environment-variable access.
repo/mem0/configs/vector_stores/pinecone.py:27 
        if not api_key and not client and "PINECONE_API_KEY" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #24eee328aaeef4aa — Environment-variable access.
repo/mem0/configs/vector_stores/turbopuffer.py:26 
        if not api_key and "TURBOPUFFER_API_KEY" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d38aaf7046fa35e9 — Environment-variable access.
repo/mem0/configs/vector_stores/upstash_vector.py:27 
        url = values.get("url") or os.environ.get("UPSTASH_VECTOR_REST_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6059fb03c255a437 — Environment-variable access.
repo/mem0/configs/vector_stores/upstash_vector.py:28 
        token = values.get("token") or os.environ.get("UPSTASH_VECTOR_REST_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a661d602ab8c86d2 — Environment-variable access.
repo/mem0/embeddings/aws_bedrock.py:28 
        aws_access_key = os.environ.get("AWS_ACCESS_KEY_ID", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #236ba96bb9e19606 — Environment-variable access.
repo/mem0/embeddings/aws_bedrock.py:29 
        aws_secret_key = os.environ.get("AWS_SECRET_ACCESS_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e8dfd99ffbfaccc9 — Environment-variable access.
repo/mem0/embeddings/aws_bedrock.py:30 
        aws_session_token = os.environ.get("AWS_SESSION_TOKEN", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6b0a2b5d86bbc838 — Environment-variable access.
repo/mem0/embeddings/azure_openai.py:17 
        api_key = self.config.azure_kwargs.api_key or os.getenv("EMBEDDING_AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b74f24c9cb039338 — Environment-variable access.
repo/mem0/embeddings/azure_openai.py:18 
        azure_deployment = self.config.azure_kwargs.azure_deployment or os.getenv("EMBEDDING_AZURE_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6a483262fc06468 — Environment-variable access.
repo/mem0/embeddings/azure_openai.py:19 
        azure_endpoint = self.config.azure_kwargs.azure_endpoint or os.getenv("EMBEDDING_AZURE_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2e068358bbb51de — Environment-variable access.
repo/mem0/embeddings/azure_openai.py:20 
        api_version = self.config.azure_kwargs.api_version or os.getenv("EMBEDDING_AZURE_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #985346ba07016b3b — Environment-variable access.
repo/mem0/embeddings/gemini.py:18 
        api_key = self.config.api_key or os.getenv("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #907448a29fb9a913 — Environment-variable access.
repo/mem0/embeddings/openai.py:21 
        api_key = self.config.api_key or os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72dfbf2995bbdfd0 — Environment-variable access.
repo/mem0/embeddings/openai.py:24 
            or os.getenv("OPENAI_API_BASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f3d7bf10bd86c74 — Environment-variable access.
repo/mem0/embeddings/openai.py:25 
            or os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5eef2ccf464aedbb — Environment-variable access.
repo/mem0/embeddings/openai.py:28 
        if os.environ.get("OPENAI_API_BASE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e484fce0e3856349 — Environment-variable access.
repo/mem0/embeddings/together.py:15 
        api_key = self.config.api_key or os.getenv("TOGETHER_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #315daa738e02e324 — Environment-variable access.
repo/mem0/embeddings/vertexai.py:36 
                os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = credentials_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #635ebcae64e0f569 — Environment-variable access.
repo/mem0/embeddings/vertexai.py:37 
            elif not os.getenv("GOOGLE_APPLICATION_CREDENTIALS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93819a2760bd870e — Environment-variable access.
repo/mem0/llms/anthropic.py:40 
        api_key = self.config.api_key or os.getenv("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d42b42293b8365a5 — Environment-variable access.
repo/mem0/llms/anthropic.py:41 
        base_url = self.config.anthropic_base_url or os.getenv("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ee43ba4e9884388b — Environment-variable access.
repo/mem0/llms/azure_openai.py:46 
        api_key = self.config.azure_kwargs.api_key or os.getenv("LLM_AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eee67d0bc3101a7c — Environment-variable access.
repo/mem0/llms/azure_openai.py:47 
        azure_deployment = self.config.azure_kwargs.azure_deployment or os.getenv("LLM_AZURE_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d311aab0781b851 — Environment-variable access.
repo/mem0/llms/azure_openai.py:48 
        azure_endpoint = self.config.azure_kwargs.azure_endpoint or os.getenv("LLM_AZURE_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c37bb9700a40c949 — Environment-variable access.
repo/mem0/llms/azure_openai.py:49 
        api_version = self.config.azure_kwargs.api_version or os.getenv("LLM_AZURE_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #553ded68f751eac6 — Environment-variable access.
repo/mem0/llms/azure_openai_structured.py:24 
        api_key = self.config.azure_kwargs.api_key or os.getenv("LLM_AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc1e0ab1f7c103c8 — Environment-variable access.
repo/mem0/llms/azure_openai_structured.py:25 
        azure_deployment = self.config.azure_kwargs.azure_deployment or os.getenv("LLM_AZURE_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #755edc2ae81df0d2 — Environment-variable access.
repo/mem0/llms/azure_openai_structured.py:26 
        azure_endpoint = self.config.azure_kwargs.azure_endpoint or os.getenv("LLM_AZURE_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9a1cfdac119fa7c — Environment-variable access.
repo/mem0/llms/azure_openai_structured.py:27 
        api_version = self.config.azure_kwargs.api_version or os.getenv("LLM_AZURE_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0cade646e34c5969 — Environment-variable access.
repo/mem0/llms/deepseek.py:39 
        api_key = self.config.api_key or os.getenv("DEEPSEEK_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #199bd3024091a687 — Environment-variable access.
repo/mem0/llms/deepseek.py:40 
        base_url = self.config.deepseek_base_url or os.getenv("DEEPSEEK_API_BASE") or "https://api.deepseek.com"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97f01c6abd4c6653 — Environment-variable access.
repo/mem0/llms/gemini.py:42 
            api_key = self.config.api_key or os.getenv("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #122ebf4e2c6d7ab7 — Environment-variable access.
repo/mem0/llms/groq.py:25 
        api_key = self.config.api_key or os.getenv("GROQ_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97c63d1af1b1aa87 — Environment-variable access.
repo/mem0/llms/minimax.py:39 
        api_key = self.config.api_key or os.getenv("MINIMAX_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d2968142c037a03a — Environment-variable access.
repo/mem0/llms/minimax.py:42 
            or os.getenv("MINIMAX_API_BASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4ad162e1925e384 — Environment-variable access.
repo/mem0/llms/openai.py:42 
        if os.environ.get("OPENROUTER_API_KEY"):  # Use OpenRouter

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9f7e976ae3463ea — Environment-variable access.
repo/mem0/llms/openai.py:44 
                api_key=os.environ.get("OPENROUTER_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f90453f256a2c8a — Environment-variable access.
repo/mem0/llms/openai.py:46 
                or os.getenv("OPENROUTER_API_BASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bbd4a752580595da — Environment-variable access.
repo/mem0/llms/openai.py:50 
            api_key = self.config.api_key or os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #880911454ab86061 — Environment-variable access.
repo/mem0/llms/openai.py:51 
            base_url = self.config.openai_base_url or os.getenv("OPENAI_BASE_URL") or "https://api.openai.com/v1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #24cc226c3ec5e8d0 — Environment-variable access.
repo/mem0/llms/openai.py:113 
        if os.getenv("OPENROUTER_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b0aefeb9f37d586 — Environment-variable access.
repo/mem0/llms/openai_structured.py:17 
        api_key = self.config.api_key or os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #226f4084b5536b91 — Environment-variable access.
repo/mem0/llms/openai_structured.py:18 
        base_url = self.config.openai_base_url or os.getenv("OPENAI_BASE_URL") or "https://api.openai.com/v1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #80e1e073b5033ece — Environment-variable access.
repo/mem0/llms/sarvam.py:19 
        self.api_key = self.config.api_key or os.getenv("SARVAM_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d767d07384d65b3b — Environment-variable access.
repo/mem0/llms/sarvam.py:28 
            getattr(self.config, "sarvam_base_url", None) or os.getenv("SARVAM_API_BASE") or "https://api.sarvam.ai/v1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #fd7a09f71eb15990 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/mem0/llms/sarvam.py:81 
            response = requests.post(url, headers=headers, json=params, timeout=30)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #4fbe740719ffd9eb — Environment-variable access.
repo/mem0/llms/together.py:22 
        api_key = self.config.api_key or os.getenv("TOGETHER_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19ad86ba2c572133 — Environment-variable access.
repo/mem0/llms/vllm.py:39 
        self.config.api_key = self.config.api_key or os.getenv("VLLM_API_KEY") or "vllm-api-key"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d23af906a66a8cc0 — Environment-variable access.
repo/mem0/llms/vllm.py:40 
        base_url = self.config.vllm_base_url or os.getenv("VLLM_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7af3db67c5c1bc7 — Environment-variable access.
repo/mem0/llms/xai.py:39 
        api_key = self.config.api_key or os.getenv("XAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #961a1bb74ccd21cb — Environment-variable access.
repo/mem0/llms/xai.py:40 
        base_url = self.config.xai_base_url or os.getenv("XAI_API_BASE") or "https://api.x.ai/v1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0170704ddd3bed6c — Environment-variable access.
repo/mem0/reranker/cohere_reranker.py:30 
        self.api_key = config.api_key or os.getenv("COHERE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7d2d57e405bc92b — Environment-variable access.
repo/mem0/reranker/zero_entropy_reranker.py:30 
        self.api_key = config.api_key or os.getenv("ZERO_ENTROPY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e018261bb18dad06 — Filesystem access.
repo/mem0/utils/gcp_auth.py:60 
            with open(credentials_path, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aae875eb8311b56b — Environment-variable access.
repo/mem0/utils/gcp_auth.py:65 
        elif os.getenv("GOOGLE_APPLICATION_CREDENTIALS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f0a90a782b3d531 — Environment-variable access.
repo/mem0/utils/gcp_auth.py:66 
            env_path = os.getenv("GOOGLE_APPLICATION_CREDENTIALS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eb329fc504d4aaec — Filesystem access.
repo/mem0/utils/gcp_auth.py:72 
                with open(env_path, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9eeb5aefa81c090 — Environment-variable access.
repo/mem0/utils/gcp_auth.py:126 
        final_project_id = project_id or detected_project_id or os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e7e16ccc06305f8 — Filesystem access.
repo/mem0/vector_stores/faiss.py:76 
    with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8fc144912d5cbf24 — Filesystem access.
repo/mem0/vector_stores/faiss.py:194 
                with open(json_docstore_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71563d550ad1383f — Filesystem access.
repo/mem0/vector_stores/faiss.py:245 
            with open(json_docstore_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #605e7212d8b31b9b — Environment-variable access.
repo/mem0/vector_stores/pinecone.py:61 
            api_key = api_key or os.environ.get("PINECONE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2de67186d2426a5b — Environment-variable access.
repo/mem0/vector_stores/turbopuffer.py:49 
        api_key = api_key or os.environ.get("TURBOPUFFER_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be12a2f4ed77d834 — Environment-variable access.
repo/openmemory/api/alembic/env.py:49 
    url = os.getenv("DATABASE_URL", "sqlite:///./openmemory.db")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94092026165c0a80 — Environment-variable access.
repo/openmemory/api/alembic/env.py:69 
    configuration["sqlalchemy.url"] = os.getenv("DATABASE_URL", "sqlite:///./openmemory.db")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fd893a026e3d8700 — Environment-variable access.
repo/openmemory/api/app/config.py:3 
USER_ID = os.getenv("USER", "default_user")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #259d88775addefee — Environment-variable access.
repo/openmemory/api/app/database.py:10 
DATABASE_URL = os.getenv("DATABASE_URL", "sqlite:///./openmemory.db")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b2c67ad0de76c44 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:56 
    custom_host = os.environ.get('OLLAMA_HOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3cf7c5b90240f953 — Filesystem access.
repo/openmemory/api/app/utils/memory.py:81 
        with open('/proc/net/route', 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da03291dcd0cba9b — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:236 
    if os.environ.get('CHROMA_HOST') and os.environ.get('CHROMA_PORT'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ef03717eda62193 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:239 
            "host": os.environ.get('CHROMA_HOST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c5da13e2b44d9469 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:240 
            "port": int(os.environ.get('CHROMA_PORT'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #78bcbb9cfb4ea756 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:242 
    elif os.environ.get('QDRANT_HOST') and os.environ.get('QDRANT_PORT'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #067d493476f01da7 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:245 
            "host": os.environ.get('QDRANT_HOST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f907218af1410b7 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:246 
            "port": int(os.environ.get('QDRANT_PORT'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #28b335146d515234 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:248 
    elif os.environ.get('WEAVIATE_CLUSTER_URL') or (os.environ.get('WEAVIATE_HOST') and os.environ.get('WEAVIATE_PORT')):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5f7133ba52bf4571 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:251 
        cluster_url = os.environ.get('WEAVIATE_CLUSTER_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7fdc42df3f216981 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:253 
            weaviate_host = os.environ.get('WEAVIATE_HOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5249fa73eff8d821 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:254 
            weaviate_port = int(os.environ.get('WEAVIATE_PORT'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bbd645384fd1191a — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:260 
    elif os.environ.get('REDIS_URL'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2f35c236bfd82c6 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:264 
            "redis_url": os.environ.get('REDIS_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0a34ecc14c9c0e2c — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:266 
    elif os.environ.get('PG_HOST') and os.environ.get('PG_PORT'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #797b237b238e67ba — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:269 
            "host": os.environ.get('PG_HOST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fa4b4de6d4971c8b — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:270 
            "port": int(os.environ.get('PG_PORT')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06e83a382863ecfe — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:271 
            "dbname": os.environ.get('PG_DB', 'mem0'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #adbf67aff65b7fb2 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:272 
            "user": os.environ.get('PG_USER', 'mem0'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #48f40b77f7237de1 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:273 
            "password": os.environ.get('PG_PASSWORD', 'mem0')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ea61091b62a97b73 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:275 
    elif os.environ.get('MILVUS_HOST') and os.environ.get('MILVUS_PORT'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21aa6eafeba4c893 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:278 
        milvus_host = os.environ.get('MILVUS_HOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9a34efa1a95d343c — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:279 
        milvus_port = int(os.environ.get('MILVUS_PORT'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72d7b94290aa5e20 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:285 
            "token": os.environ.get('MILVUS_TOKEN', ''),  # Always include, empty string for local setup

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1cc8cec2c40848fe — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:286 
            "db_name": os.environ.get('MILVUS_DB_NAME', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #01914c36d19dc005 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:290 
    elif os.environ.get('ELASTICSEARCH_HOST') and os.environ.get('ELASTICSEARCH_PORT'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f98018873be6e10c — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:293 
        elasticsearch_host = os.environ.get('ELASTICSEARCH_HOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #320accc0479b90d0 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:294 
        elasticsearch_port = int(os.environ.get('ELASTICSEARCH_PORT'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7900330ef1252ab4 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:301 
            "user": os.environ.get('ELASTICSEARCH_USER', 'elastic'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4e30df0796643d8 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:302 
            "password": os.environ.get('ELASTICSEARCH_PASSWORD', 'changeme'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dcf9d24f43b9aa3e — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:307 
    elif os.environ.get('OPENSEARCH_HOST') and os.environ.get('OPENSEARCH_PORT'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ae0ab01a1699f191 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:310 
            "host": os.environ.get('OPENSEARCH_HOST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c82f854df887189f — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:311 
            "port": int(os.environ.get('OPENSEARCH_PORT'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94d50a37b588f328 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:313 
    elif os.environ.get('FAISS_PATH'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cdc49c3232e06987 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:317 
            "path": os.environ.get('FAISS_PATH'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #61673e1f890c61e6 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:331 
    llm_provider = os.environ.get('LLM_PROVIDER', 'openai').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9556e021f7de78ba — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:332 
    llm_model = os.environ.get('LLM_MODEL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ccbfd5dd29238895 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:333 
    llm_api_key = os.environ.get('LLM_API_KEY')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e4034696724686d — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:334 
    llm_base_url = os.environ.get('LLM_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dbbe83c0be2ef222 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:335 
    ollama_base_url = os.environ.get('OLLAMA_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #43e18485b9ef134e — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:347 
    embedder_provider = os.environ.get('EMBEDDER_PROVIDER', llm_provider if llm_provider == 'ollama' else 'openai').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4c0e604a1108af5d — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:348 
    embedder_model = os.environ.get('EMBEDDER_MODEL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b3ee75dac73a53e1 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:349 
    embedder_api_key = os.environ.get('EMBEDDER_API_KEY')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #029c2375e03bf473 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:350 
    embedder_base_url = os.environ.get('EMBEDDER_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1e11c56b8c4f96c2 — Environment-variable access.
repo/openmemory/api/app/utils/memory.py:389 
                env_value = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3e6cd3d5a7df6c29 — Filesystem access.
repo/scripts/check-llms-txt-coverage.py:45 
    for raw in IGNORE_FILE.read_text().splitlines():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #428d58499f4dc170 — Filesystem access.
repo/scripts/check-llms-txt-coverage.py:108 
    text = LLMS_TXT.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7242a2eb29b4931e — Filesystem access.
repo/scripts/check-llms-txt-coverage.py:134 
            LLMS_TXT.write_text(new_text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06b478237f3eeaa8 — Environment-variable access.
repo/server/auth.py:15 
JWT_SECRET = os.environ.get("JWT_SECRET", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5202811fc37cab7b — Environment-variable access.
repo/server/auth.py:19 
ADMIN_API_KEY = os.environ.get("ADMIN_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6c16a675929d6b24 — Environment-variable access.
repo/server/auth.py:20 
AUTH_DISABLED = os.environ.get("AUTH_DISABLED", "").lower() in {"1", "true", "yes", "on"}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #101ce813c7f1abe3 — Environment-variable access.
repo/server/db.py:8 
    host = os.environ.get("POSTGRES_HOST", "postgres")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b78b8255dacf9384 — Environment-variable access.
repo/server/db.py:9 
    port = os.environ.get("POSTGRES_PORT", "5432")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69b73ca54e6ee250 — Environment-variable access.
repo/server/db.py:10 
    user = os.environ.get("POSTGRES_USER", "postgres")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6507f2be97671cd0 — Environment-variable access.
repo/server/db.py:11 
    password = os.environ.get("POSTGRES_PASSWORD", "postgres")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aeafa104347dd1d1 — Environment-variable access.
repo/server/db.py:12 
    db = os.environ.get("APP_DB_NAME", "mem0_app")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad6441e404ce92dc — Environment-variable access.
repo/server/main.py:107 
POSTGRES_HOST = os.environ.get("POSTGRES_HOST", "postgres")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6a4f7d520efc904c — Environment-variable access.
repo/server/main.py:108 
POSTGRES_PORT = os.environ.get("POSTGRES_PORT", "5432")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21ba756c5abb4113 — Environment-variable access.
repo/server/main.py:109 
POSTGRES_DB = os.environ.get("POSTGRES_DB", "postgres")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #59543ccdd24ac3f8 — Environment-variable access.
repo/server/main.py:110 
POSTGRES_USER = os.environ.get("POSTGRES_USER", "postgres")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f7a6aa31323d8606 — Environment-variable access.
repo/server/main.py:111 
POSTGRES_PASSWORD = os.environ.get("POSTGRES_PASSWORD", "postgres")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #091ff18196d94686 — Environment-variable access.
repo/server/main.py:112 
POSTGRES_COLLECTION_NAME = os.environ.get("POSTGRES_COLLECTION_NAME", "memories")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe60e78446b9adf4 — Environment-variable access.
repo/server/main.py:114 
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64008333398499c1 — Environment-variable access.
repo/server/main.py:115 
HISTORY_DB_PATH = os.environ.get("HISTORY_DB_PATH", "/app/history/history.db")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #258d354f4285dd24 — Environment-variable access.
repo/server/main.py:116 
DEFAULT_LLM_MODEL = os.environ.get("MEM0_DEFAULT_LLM_MODEL", "gpt-4.1-nano-2025-04-14")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53fd7a9b88f81378 — Environment-variable access.
repo/server/main.py:117 
DEFAULT_EMBEDDER_MODEL = os.environ.get("MEM0_DEFAULT_EMBEDDER_MODEL", "text-embedding-3-small")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1aafca0ff80d946c — Environment-variable access.
repo/server/main.py:159 
DASHBOARD_URL = os.environ.get("DASHBOARD_URL", "http://localhost:3000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #21cf66a7b877957b — Environment-variable access.
repo/server/scripts/prune_request_logs.py:17 
    raw = os.environ.get("REQUEST_LOG_RETENTION_DAYS", "").strip() or "30"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d8fb4fc04a204234 — Environment-variable access.
repo/server/scripts/reset_admin_password.py:16 
    email = os.environ.get("EMAIL", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f4006df3965f86d0 — Environment-variable access.
repo/server/scripts/reset_admin_password.py:17 
    password = os.environ.get("PASSWORD", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #c82cb50a5acd5873 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/server/server_state.py:28 
            row = session.get(Settings, "config_overrides")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #38e4249f4138b5e0 — Environment-variable access.
repo/server/telemetry.py:27 
ENABLED = os.environ.get("MEM0_TELEMETRY", "true").lower() not in {"0", "false", "no", "off"}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d0e9dfbb61f4470f — Environment-variable access.
repo/server/telemetry.py:28 
STATE_PATH = Path(os.environ.get("MEM0_TELEMETRY_STATE_PATH", "/app/history/telemetry.json"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6dd8714fbe7672b2 — Filesystem access.
repo/server/telemetry.py:39 
        return json.loads(STATE_PATH.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5023aaaac4034a04 — Filesystem access.
repo/server/telemetry.py:47 
        STATE_PATH.write_text(json.dumps(state))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress test-only Excluded from app score #6ae76f15c6178172 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/skills/mem0/scripts/mem0_doc_search.py:79 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

first-party (python): cli/python

python first-party
medium pii_flow production #c84b644d658dd690 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
repo/cli/python/src/mem0_cli/backend/platform.py:27 · flow /tmp/closeopen-wiuwd3vh/repo/cli/python/src/mem0_cli/backend/platform.py:28 → /tmp/closeopen-wiuwd3vh/repo/cli/python/src/mem0_cli/backend/platform.py:27 
            headers={
                "Authorization": f"Token {config.api_key}",
                "Content-Type": "application/json",
                "X-Mem0-Source": "cli",
                "X-Mem0-Client-Language": "python",
                "X-Mem0-Client-Version": __version__,
            },

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium telemetry production #84d33ab4bdb71a74 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/cli/python/src/mem0_cli/commands/utils.py:130 
    for item in track(
        data, description=f"[{DIM_COLOR}]Importing memories...[/]", console=err_console
    ):

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 32 low-confidence finding(s)
low env_fs production #26c477d055eca4ba — Environment-variable access.
repo/cli/python/src/mem0_cli/agent_detect.py:34 
        if any(os.environ.get(v) for v in env_vars):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #795f29e2fd3c690c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/backend/platform.py:41 
        resp = self._client.request(method, path, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #8cbdd432d572e204 — Environment-variable access.
repo/cli/python/src/mem0_cli/branding.py:39 
    if not sys.stdout.isatty() or os.environ.get("NO_COLOR") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #303521ef4388fdf4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/commands/agent_mode_cmd.py:80 
            resp = client.post(
                f"{base_url}/api/v1/auth/agent_mode/",
                headers={**_SOURCE_HEADERS, "Content-Type": "application/json"},
                json=body,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #97c48ab5dfebe7d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/commands/agent_mode_cmd.py:167 
            send = client.post(
                f"{base_url}/api/v1/auth/email_code/",
                headers={**_SOURCE_HEADERS, "Content-Type": "application/json"},
                json={"email": email},
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f23587b90f59cabc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/commands/agent_mode_cmd.py:200 
        verify = client.post(
            f"{base_url}/api/v1/auth/email_code/verify/",
            headers={**_SOURCE_HEADERS, "Content-Type": "application/json"},
            json={
                "email": email,
                "code": code.strip(),
                "agent_mode_api_key": raw_key,
            },
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ca54d70dca4400e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/commands/agent_rush_cmd.py:56 
            resp = client.post(
                f"{base_url}{path}",
                headers={
                    **_SOURCE_HEADERS,
                    "Authorization": f"Token {config.platform.api_key}",
                    "Content-Type": "application/json",
                },
                json=body,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c664c211a82a1f34 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:115 
        resp = httpx.get(
            f"{base_url.rstrip('/')}/v1/ping/",
            headers={"Authorization": f"Token {api_key}"},
            timeout=timeout,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #386d2634eaf05e0d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:145 
            resp = client.post(
                f"{url}/api/v1/auth/email_code/",
                json={"email": email},
                headers=_source_headers,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e5846eef3fb7d8e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:178 
        resp = client.post(
            f"{url}/api/v1/auth/email_code/verify/",
            json={"email": email, "code": code.strip()},
            headers=_source_headers,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #693099c2e01108f8 — Environment-variable access.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:244 
    base_url = os.environ.get("MEM0_BASE_URL", config.platform.base_url or DEFAULT_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e8226ef6d5b19799 — Environment-variable access.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:319 
        _env_key = (os.environ.get("MEM0_API_KEY") or "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a2753c417d7d568 — Environment-variable access.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:388 
            user_id or os.environ.get("USER") or os.environ.get("USERNAME") or "mem0-cli"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ef4bd116c9bb467 — Environment-variable access.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:415 
        user_id = user_id or os.environ.get("USER") or os.environ.get("USERNAME") or "mem0-cli"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e22e88ce6158203e — Environment-variable access.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:463 
                user_id or os.environ.get("USER") or os.environ.get("USERNAME") or "mem0-cli"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #01acec6d99abd9f0 — Environment-variable access.
repo/cli/python/src/mem0_cli/commands/init_cmd.py:528 
    _default_user = os.environ.get("USER") or os.environ.get("USERNAME") or "mem0-cli"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54f771f5c5f3a460 — Filesystem access.
repo/cli/python/src/mem0_cli/commands/memory.py:79 
            raw = Path(file).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d3d4511c3be563b8 — Filesystem access.
repo/cli/python/src/mem0_cli/commands/utils.py:119 
        data = json.loads(Path(file_path).read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e51f9b557c2fda1b — Filesystem access.
repo/cli/python/src/mem0_cli/config.py:93 
        with open(CONFIG_FILE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #95a4edec910186e0 — Environment-variable access.
repo/cli/python/src/mem0_cli/config.py:120 
    env_key = os.environ.get("MEM0_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #322d408fb2ae7ddb — Environment-variable access.
repo/cli/python/src/mem0_cli/config.py:124 
    env_base = os.environ.get("MEM0_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e7b9e15939e22f07 — Environment-variable access.
repo/cli/python/src/mem0_cli/config.py:128 
    env_user_id = os.environ.get("MEM0_USER_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4bf191a8b7f8a5e — Environment-variable access.
repo/cli/python/src/mem0_cli/config.py:132 
    env_agent_id = os.environ.get("MEM0_AGENT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b4f6945f74019ef — Environment-variable access.
repo/cli/python/src/mem0_cli/config.py:136 
    env_app_id = os.environ.get("MEM0_APP_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4b832f2e47ae8d3 — Environment-variable access.
repo/cli/python/src/mem0_cli/config.py:140 
    env_run_id = os.environ.get("MEM0_RUN_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3879712382d18121 — Filesystem access.
repo/cli/python/src/mem0_cli/config.py:177 
    with open(CONFIG_FILE, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b7b2bd1bfd2ca866 — Filesystem access.
repo/cli/python/src/mem0_cli/plugin_sync.py:92 
        text = path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd5f2644c772f2b0 — Environment-variable access.
repo/cli/python/src/mem0_cli/telemetry.py:27 
    val = os.environ.get("MEM0_TELEMETRY", "true").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #0270db6bb4635ea2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/telemetry_sender.py:77 
        resp = urllib.request.urlopen(req, timeout=10)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #2d81ce0f5fa738f5 — Filesystem access.
repo/cli/python/src/mem0_cli/telemetry_sender.py:92 
        with open(config_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a31fd998a16230e4 — Filesystem access.
repo/cli/python/src/mem0_cli/telemetry_sender.py:95 
        with open(config_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #313830025c4dc179 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/cli/python/src/mem0_cli/telemetry_sender.py:110 
        urllib.request.urlopen(req, timeout=10)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

first-party (python): mem0/memory

python first-party
medium telemetry production #d431b0077c56158b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/mem0/memory/telemetry.py:9 
from posthog import Posthog

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 4 low-confidence finding(s)
low env_fs production #32265851b5e2964e — Environment-variable access.
repo/mem0/memory/setup.py:11 
mem0_dir = os.environ.get("MEM0_DIR") or os.path.join(home_dir, ".mem0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32b2f925988ce846 — Filesystem access.
repo/mem0/memory/setup.py:27 
        with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1eae34d33fbc44d4 — Environment-variable access.
repo/mem0/memory/telemetry.py:14 
MEM0_TELEMETRY = os.environ.get("MEM0_TELEMETRY", "True")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6735b64201aad806 — Environment-variable access.
repo/mem0/memory/telemetry.py:48 
MEM0_TELEMETRY_SAMPLE_RATE = _parse_sample_rate(os.environ.get("MEM0_TELEMETRY_SAMPLE_RATE", str(_DEFAULT_SAMPLE_RATE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (npm): integrations/openclaw

python first-party
expand_more 4 low-confidence finding(s)
low env_fs test-only Excluded from app score #7afde3a75a98c69e — Environment-variable access.
repo/integrations/openclaw/scripts/configure.py:11 
    api_key = os.environ.get("MEM0_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a2a70f227bccf507 — Environment-variable access.
repo/integrations/openclaw/scripts/configure.py:12 
    user_id = os.environ.get("MEM0_USER_ID", os.environ.get("USER", "default"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #743ca8623bb5002c — Filesystem access.
repo/integrations/openclaw/scripts/configure.py:31 
    with open(config_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0442b951cf2e7d34 — Filesystem access.
repo/integrations/openclaw/scripts/configure.py:63 
    with open(config_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

posthog

python dependency
medium telemetry dependency Excluded from app score #8ee91e03bf0c9eb1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:6 
from posthog.args import (
    ID_TYPES as ID_TYPES,
    ExceptionArg,
    OptionalCaptureArgs,
    OptionalSetArgs,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ff580a5612c227d5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:12 
from posthog.capture_compression import CaptureCompression as CaptureCompression

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7be5f73325dc080d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:13 
from posthog.capture_mode import CaptureMode as CaptureMode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9ae9020f38a05f09 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:14 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #72c76659d7e96619 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:15 
from posthog.exception_capture import ExceptionCapture

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9d4fc1de66d8ec6f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:16 
from posthog.contexts import (
    identify_context as inner_identify_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #20b6616e190e451d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:19 
from posthog.contexts import (
    new_context as inner_new_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0d10eddc162be6d9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:22 
from posthog.contexts import (
    scoped as inner_scoped,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #04a4d2920bc3899f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:25 
from posthog.contexts import (
    set_capture_exception_code_variables_context as inner_set_capture_exception_code_variables_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ed9e2bf9bf9d56b3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:28 
from posthog.contexts import (
    set_code_variables_ignore_patterns_context as inner_set_code_variables_ignore_patterns_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #07261db1162d0f0a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:31 
from posthog.contexts import (
    set_code_variables_mask_patterns_context as inner_set_code_variables_mask_patterns_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #07dde76b7fe6b7cd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:34 
from posthog.contexts import (
    set_code_variables_mask_url_credentials_context as inner_set_code_variables_mask_url_credentials_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e827ac96710b6b26 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:37 
from posthog.contexts import (
    set_code_variables_detect_secrets_context as inner_set_code_variables_detect_secrets_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #47845fd08db4813a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:40 
from posthog.contexts import (
    set_context_device_id as inner_set_context_device_id,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #bd106090489430f8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:43 
from posthog.contexts import (
    set_context_session as inner_set_context_session,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a23dd4dc3835885d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:46 
from posthog.contexts import (
    tag as inner_tag,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #534d33da54bb95f3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:49 
from posthog.contexts import (
    get_tags as inner_get_tags,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #26ce92a9df418ad9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:52 
from posthog.exception_utils import (
    DEFAULT_CODE_VARIABLES_DETECT_SECRETS,
    DEFAULT_CODE_VARIABLES_IGNORE_PATTERNS,
    DEFAULT_CODE_VARIABLES_MASK_PATTERNS,
    DEFAULT_CODE_VARIABLES_MASK_URL_CREDENTIALS,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8e8bb4ceddf72669 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:58 
from posthog.feature_flag_evaluations import (
    FeatureFlagEvaluations as FeatureFlagEvaluations,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #14efdf5335440de9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:61 
from posthog.feature_flags import (
    InconclusiveMatchError as InconclusiveMatchError,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #04f26c6293c066b1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:64 
from posthog.feature_flags import (
    RequiresServerEvaluation as RequiresServerEvaluation,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #feacfaacc93d6d56 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:67 
from posthog.flag_definition_cache import (
    FlagDefinitionCacheData as FlagDefinitionCacheData,
    FlagDefinitionCacheProvider as FlagDefinitionCacheProvider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fda846dbb48f78c4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:71 
from posthog.request import (
    disable_connection_reuse as disable_connection_reuse,
    enable_keep_alive as enable_keep_alive,
    set_socket_options as set_socket_options,
    SocketOptions as SocketOptions,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c090b77b2cb31219 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:77 
from posthog.types import (
    BeforeSendCallback as BeforeSendCallback,
    FeatureFlag as FeatureFlag,
    FlagValue as FlagValue,
    FlagsAndPayloads as FlagsAndPayloads,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9c39253711cb26a2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:83 
from posthog.types import (
    FeatureFlagResult as FeatureFlagResult,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #bbdf21371a265c34 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/__init__.py:86 
from posthog.version import VERSION

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #80f41710d3d5400e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/__init__.py:1 
from posthog.ai.prompts import PromptResult, PromptSource, Prompts

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #42c400e6fe82d620 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:13 
from posthog.ai.types import StreamingContentBlock, TokenUsage, ToolInProgress

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5aa3e4fe27e44bba — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:14 
from posthog.ai.utils import (
    call_llm_and_track_usage,
    merge_usage_stats,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c9dfbcf6f09e5e74 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:18 
from posthog.ai.anthropic.anthropic_converter import (
    extract_anthropic_usage_from_event,
    handle_anthropic_content_block_start,
    handle_anthropic_text_delta,
    handle_anthropic_tool_delta,
    finalize_anthropic_tool_input,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1d7cfbcc2d9909b4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:25 
from posthog.ai.sanitization import sanitize_anthropic

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ff6536bcca6dad89 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:26 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9ffcd5794855deff — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:27 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #270cab6e8cc39b9a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:244 
        from posthog.ai.types import StreamingEventData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f513dc97d1faafa2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:245 
        from posthog.ai.anthropic.anthropic_converter import (
            format_anthropic_streaming_input,
            format_anthropic_streaming_output_complete,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d84e8e369ca83d75 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic.py:249 
        from posthog.ai.utils import capture_streaming_event

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c7f3d5ee59fe4c85 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:13 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7bac19a8b8b5c4fa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:14 
from posthog.ai.stream import AsyncStreamWrapper

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #018a8b533abb579d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:15 
from posthog.ai.types import StreamingContentBlock, TokenUsage, ToolInProgress

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #eb65971d4e1fbfb0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:16 
from posthog.ai.utils import (
    call_llm_and_track_usage_async,
    merge_usage_stats,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9c31077f28e074c4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:20 
from posthog.ai.anthropic.anthropic_converter import (
    extract_anthropic_usage_from_event,
    handle_anthropic_content_block_start,
    handle_anthropic_text_delta,
    handle_anthropic_tool_delta,
    finalize_anthropic_tool_input,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #dbf7651eb72f5ed3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:27 
from posthog.ai.sanitization import sanitize_anthropic

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4a776997d425007c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:28 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1b98df1ec6602530 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:245 
        from posthog.ai.types import StreamingEventData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e25befd31640c4da — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:246 
        from posthog.ai.anthropic.anthropic_converter import (
            format_anthropic_streaming_input,
            format_anthropic_streaming_output_complete,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #93103e4bc4168676 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_async.py:250 
        from posthog.ai.utils import capture_streaming_event

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #902e8677d43c950f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_converter.py:11 
from posthog.ai.types import (
    FormattedContentItem,
    FormattedFunctionCall,
    FormattedMessage,
    FormattedTextContent,
    StreamingContentBlock,
    TokenUsage,
    ToolInProgress,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a2881b4697c345be — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_converter.py:20 
from posthog.ai.utils import serialize_raw_usage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #07779c703cf9b048 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_converter.py:435 
    from posthog.ai.utils import merge_system_prompt

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d0a1eb70410128d2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_providers.py:10 
from posthog.ai.anthropic.anthropic import WrappedMessages

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ea875418adf0b44b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_providers.py:11 
from posthog.ai.anthropic.anthropic_async import AsyncWrappedMessages

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #16fc912edd60eacd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_providers.py:12 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #172b3440331fa08c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/anthropic/anthropic_providers.py:13 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #793fa73688a34278 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/claude_agent_sdk/__init__.py:9 
    from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9d759a675608a67b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/claude_agent_sdk/__init__.py:18 
from posthog.ai.claude_agent_sdk.client import PostHogClaudeSDKClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1e1f40c2ceb91cb6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/claude_agent_sdk/__init__.py:19 
from posthog.ai.claude_agent_sdk.processor import PostHogClaudeAgentProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a2a2390e31d046e9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/claude_agent_sdk/client.py:26 
from posthog.ai.claude_agent_sdk.processor import (
    PostHogClaudeAgentProcessor,
    _GenerationTracker,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a6ae5d254baac91d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/claude_agent_sdk/client.py:30 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8e0f702e968bf7e0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/claude_agent_sdk/processor.py:27 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5f93a597a59bcd86 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/claude_agent_sdk/processor.py:28 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2a9a0a850da42672 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:6 
from posthog.ai.types import TokenUsage, StreamingEventData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c7abcf595b74f33f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:7 
from posthog.ai.utils import merge_system_prompt

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4af434ad37da766e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:16 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #83b6797169bb2487 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:17 
from posthog.ai.utils import (
    call_llm_and_track_usage,
    capture_streaming_event,
    merge_usage_stats,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #93f8551112bdf310 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:22 
from posthog.ai.gemini.gemini_converter import (
    extract_gemini_embedding_token_count,
    extract_gemini_usage_from_chunk,
    extract_gemini_content_from_chunk,
    extract_gemini_stop_reason_from_chunk,
    format_gemini_streaming_output,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4ace402cad52cc46 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:29 
from posthog.ai.utils import with_privacy_mode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4715a8df2335968b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:30 
from posthog.ai.sanitization import sanitize_gemini

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6475aaed03ed82e1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:31 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fdc87eae327cb8f7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:6 
from posthog.ai.stream import AsyncStreamWrapper

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9afcf52bc0db6bac — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:7 
from posthog.ai.types import TokenUsage, StreamingEventData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e2109c5134d6885b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:8 
from posthog.ai.utils import merge_system_prompt

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #520ba253f47ac4d4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:17 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0679701e0043fe68 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:18 
from posthog.ai.utils import (
    call_llm_and_track_usage_async,
    capture_streaming_event,
    merge_usage_stats,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ec48073d57a14d07 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:23 
from posthog.ai.gemini.gemini_converter import (
    extract_gemini_embedding_token_count,
    extract_gemini_usage_from_chunk,
    extract_gemini_content_from_chunk,
    extract_gemini_stop_reason_from_chunk,
    format_gemini_streaming_output,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #574b35ed3501238a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:30 
from posthog.ai.utils import with_privacy_mode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c5f3c897923271c5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:31 
from posthog.ai.sanitization import sanitize_gemini

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #df12b9cc2463ae3f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:32 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b17cd73d230402a3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_converter.py:10 
from posthog.ai.types import (
    FormattedContentItem,
    FormattedMessage,
    TokenUsage,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #08efb81acbc41dbc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_converter.py:15 
from posthog.ai.utils import serialize_raw_usage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #56d8bd9c7cc55b1b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_converter.py:370 
            from posthog.ai.types import FormattedMessage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6a1dbe1095159a4e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/langchain/callbacks.py:44 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0c47dda79ee08880 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/langchain/callbacks.py:45 
from posthog.ai.gateway import warn_if_posthog_ai_gateway

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #198f8df178ef3b9b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/langchain/callbacks.py:46 
from posthog.ai.sanitization import sanitize_langchain

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7c547a4caa1f44e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/langchain/callbacks.py:47 
from posthog.ai.utils import get_model_params, with_privacy_mode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #005d0d0847455fa0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/langchain/callbacks.py:48 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b59efaf214b9e12f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:5 
from posthog.ai.types import TokenUsage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3ca7e85f69d480db — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:14 
from posthog.ai.utils import (
    call_llm_and_track_usage,
    extract_available_tool_calls,
    merge_usage_stats,
    with_privacy_mode,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0411f05b3f00e617 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:20 
from posthog.ai.openai.openai_converter import (
    extract_openai_usage_from_chunk,
    extract_openai_content_from_chunk,
    extract_openai_tool_calls_from_chunk,
    accumulate_openai_tool_calls,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d244b56e8506aa75 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:26 
from posthog.ai.sanitization import sanitize_openai, sanitize_openai_response

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5c71ecc0fb5b0da2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:27 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2387b3cdbd5a738a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:28 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fa2f20ad39441541 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:29 
from posthog.ai.openai.wrapper_utils import _OpenAIWrapperResource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3b4e8ad8c0497bca — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:238 
        from posthog.ai.types import StreamingEventData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fb803a9b97e99723 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:239 
        from posthog.ai.openai.openai_converter import (
            format_openai_streaming_input,
            format_openai_streaming_output,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #edb8cec143c50bf4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:243 
        from posthog.ai.utils import capture_streaming_event

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e5972d121dbeb249 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:507 
        from posthog.ai.types import StreamingEventData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e82752585d41bfb3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:508 
        from posthog.ai.openai.openai_converter import (
            format_openai_streaming_input,
            format_openai_streaming_output,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #359f4192dfb341e7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai.py:512 
        from posthog.ai.utils import capture_streaming_event

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #165d167f4d1eb678 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:5 
from posthog.ai.stream import AsyncStreamWrapper

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a31652b54a46b2f5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:6 
from posthog.ai.types import TokenUsage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fb90969bbc59a40d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:15 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2a0f2d2208e1eee1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:16 
from posthog.ai.utils import (
    call_llm_and_track_usage_async,
    extract_available_tool_calls,
    get_model_params,
    merge_usage_stats,
    with_privacy_mode,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8325cc62dc32b193 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:23 
from posthog.ai.openai.openai_converter import (
    extract_openai_usage_from_chunk,
    extract_openai_content_from_chunk,
    extract_openai_tool_calls_from_chunk,
    accumulate_openai_tool_calls,
    format_openai_streaming_output,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #244b978820c283f3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:30 
from posthog.ai.sanitization import sanitize_openai, sanitize_openai_response

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #12764b3cd5fe0d2b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:31 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a11e79fe994cb960 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_async.py:32 
from posthog.ai.openai.wrapper_utils import _OpenAIWrapperResource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6ee2237914cd068c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_converter.py:11 
from posthog.ai.types import (
    FormattedContentItem,
    FormattedFunctionCall,
    FormattedImageContent,
    FormattedMessage,
    FormattedTextContent,
    TokenUsage,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #56dff72191f061cd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_converter.py:19 
from posthog.ai.utils import serialize_raw_usage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ffbffc9f6ada0f11 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_converter.py:769 
    from posthog.ai.utils import merge_system_prompt

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e65e2a95b0729556 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_providers.py:8 
from posthog.ai.openai.openai import (
    WrappedBeta,
    WrappedChat,
    WrappedEmbeddings,
    WrappedResponses,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #44ac27ff6b358061 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_providers.py:14 
from posthog.ai.openai.openai_async import WrappedBeta as AsyncWrappedBeta

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b016a89dd8b90c92 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_providers.py:15 
from posthog.ai.openai.openai_async import WrappedChat as AsyncWrappedChat

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d70c9bb38c190368 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_providers.py:16 
from posthog.ai.openai.openai_async import WrappedEmbeddings as AsyncWrappedEmbeddings

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #13584b1b3c5389f2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_providers.py:17 
from posthog.ai.openai.openai_async import WrappedResponses as AsyncWrappedResponses

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9704cb2d06b862ff — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_providers.py:20 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #83d1242c829c1f40 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai/openai_providers.py:21 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0c2d80f51a1205f6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai_agents/__init__.py:8 
    from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ad53fe657da36b20 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai_agents/__init__.py:17 
from posthog.ai.openai_agents.processor import PostHogTracingProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #47122aac66c4662e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai_agents/processor.py:23 
from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #158e34e672f9ac12 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/openai_agents/processor.py:24 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fcf1adfe07f9ae60 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/__init__.py:29 
from posthog.ai.otel.exporter import PostHogTraceExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4e5f0153dd8d9f26 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/__init__.py:30 
from posthog.ai.otel.processor import PostHogSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1deae59b1f56bc35 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/__init__.py:31 
from posthog.ai.otel.spans import is_ai_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #80eaad7acc15922e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/exporter.py:10 
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e9a5d35a2ac52d81 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/exporter.py:11 
from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #978aa2711dc663bd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/exporter.py:12 
from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #71241123e7da104b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/processor.py:10 
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #381abf13e37e6d9e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/processor.py:11 
from opentelemetry.sdk.trace import ReadableSpan, Span, SpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2f24e803349079fd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/processor.py:12 
from opentelemetry.sdk.trace.export import BatchSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3a60650dcabf90b8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/processor.py:13 
from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6abe37cf73e3d0d4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/otel/spans.py:6 
    from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7f73c00b86754d6d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/prompts.py:15 
from posthog.request import USER_AGENT, _get_session

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a7fb120e94f0ce33 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/prompts.py:16 
from posthog.utils import remove_trailing_slash

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fbf85505c0b96007 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:5 
from posthog import get_tags, identify_context, new_context, tag, contexts

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0ac9ddaf0a44f30f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:6 
from posthog.ai.gateway import warn_if_posthog_ai_gateway

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3e027f0af0924f2c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:7 
from posthog.ai.sanitization import (
    sanitize_anthropic,
    sanitize_gemini,
    sanitize_langchain,
    sanitize_openai,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a5351ac6e347d838 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:13 
from posthog.ai.types import FormattedMessage, StreamingEventData, TokenUsage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1a9b90ce929d45b6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:14 
from posthog.client import Client as PostHogClient

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4c2bdc322e9eaaaa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:197 
        from posthog.ai.anthropic.anthropic_converter import (
            extract_anthropic_usage_from_response,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #13af02c8420e3d7a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:203 
        from posthog.ai.openai.openai_converter import (
            extract_openai_usage_from_response,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #dc62e18d2182e9b4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:209 
        from posthog.ai.gemini.gemini_converter import (
            extract_gemini_usage_from_response,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b85140a0b27bd1d4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:223 
        from posthog.ai.anthropic.anthropic_converter import format_anthropic_response

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0d55b52a89a6d802 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:227 
        from posthog.ai.openai.openai_converter import format_openai_response

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #10040008caed2109 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:231 
        from posthog.ai.gemini.gemini_converter import format_gemini_response

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #aa7791c1b6c71679 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:240 
        from posthog.ai.openai.openai_converter import extract_openai_stop_reason

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e2f66a7d1bd2c9bb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:244 
        from posthog.ai.anthropic.anthropic_converter import (
            extract_anthropic_stop_reason,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5170bce16e68a4f6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:250 
        from posthog.ai.gemini.gemini_converter import extract_gemini_stop_reason

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9f4d2fcef2396d7c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:261 
        from posthog.ai.anthropic.anthropic_converter import extract_anthropic_tools

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ebbaeb214806d7af — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:265 
        from posthog.ai.gemini.gemini_converter import extract_gemini_tools

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #953adf22e9f4fbd8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:269 
        from posthog.ai.openai.openai_converter import extract_openai_tools

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2a4a6026404f83a1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:282 
        from posthog.ai.anthropic.anthropic_converter import format_anthropic_input

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1a5fdce1cf021653 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:288 
        from posthog.ai.gemini.gemini_converter import format_gemini_input_with_system

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #37ab19e19215ed34 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/ai/utils.py:294 
        from posthog.ai.openai.openai_converter import format_openai_input

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a57f797a809f6605 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/args.py:18 
from posthog.types import SendFeatureFlagsOptions

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a7d1d111cafed711 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/args.py:21 
    from posthog.feature_flag_evaluations import FeatureFlagEvaluations

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f6ae0f860a591380 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/capture_v1.py:48 
from posthog.capture_compression import CaptureCompression, _zstandard

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #55e0172257b5d844 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/capture_v1.py:49 
from posthog.request import (
    DatetimeSerializer,
    USER_AGENT,
    APIError,
    _get_session,
    normalize_host,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1a3a203aded36c37 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/capture_v1.py:56 
from posthog.utils import guess_timezone as _guess_timezone, remove_trailing_slash

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #dd5418f84f425cc1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:17 
from posthog._async_utils import _BackgroundEventLoopRunner

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d8f4dc66bcc977f1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:18 
from posthog.args import ID_TYPES, ExceptionArg, OptionalCaptureArgs, OptionalSetArgs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b45d1932aaf7ca17 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:19 
from posthog.metrics_capture import PostHogMetrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5a1fb63a3c2d00ae — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:20 
from posthog.capture_compression import (
    CaptureCompression,
    _resolve_capture_compression,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #beff6b37d655812f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:24 
from posthog.capture_mode import CaptureMode, _resolve_capture_mode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b77a9ef584c03755 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:25 
from posthog.capture_v1 import _send_v1_batch

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0e4c35908228ebf2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:26 
from posthog.consumer import Consumer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fa53e886a2444648 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:27 
from posthog.contexts import (
    _get_current_context,
    get_capture_exception_code_variables_context,
    get_code_variables_detect_secrets_context,
    get_code_variables_ignore_patterns_context,
    get_code_variables_mask_patterns_context,
    get_code_variables_mask_url_credentials_context,
    get_context_device_id,
    get_context_distinct_id,
    get_context_session_id,
    get_tags as _context_get_tags,
    identify_context as _context_identify_context,
    _scoped as _context_scoped,
    new_context,
    set_context_device_id as _context_set_context_device_id,
    set_context_session as _context_set_context_session,
    tag as _context_tag,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #18044509da029172 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:45 
from posthog.exception_capture import ExceptionCapture

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #920551575bf5bb30 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:46 
from posthog._logging import _configure_posthog_logging

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #69e72bc67b906ad2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:47 
from posthog.exception_utils import (
    DEFAULT_CODE_VARIABLES_DETECT_SECRETS,
    DEFAULT_CODE_VARIABLES_IGNORE_PATTERNS,
    DEFAULT_CODE_VARIABLES_MASK_PATTERNS,
    DEFAULT_CODE_VARIABLES_MASK_URL_CREDENTIALS,
    exc_info_from_error,
    exception_is_already_captured,
    exceptions_from_error_tuple,
    _get_current_otel_span_properties,
    handle_in_app,
    mark_exception_as_captured,
    try_attach_code_variables_to_frames,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f19b1aa1a11b23a6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:60 
from posthog.feature_flag_evaluations import (
    FeatureFlagEvaluations,
    _EvaluatedFlagRecord,
    _FeatureFlagEvaluationsHost,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #acf4fa890b0115f1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:65 
from posthog.feature_flags import (
    InconclusiveMatchError,
    RequiresServerEvaluation,
    match_feature_flag_properties,
    resolve_bucketing_value,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #620690330e3244d9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:71 
from posthog.flag_definition_cache import (
    FlagDefinitionCacheData,
    FlagDefinitionCacheProvider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4df13861cc7cd39f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:75 
from posthog.poller import Poller

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e74955aa0ac83b49 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:76 
from posthog.request import (
    AI_EVENTS_ENDPOINT,
    EVENTS_ENDPOINT,
    APIError,
    QuotaLimitError,
    RequestsConnectionError,
    RequestsTimeout,
    batch_post,
    determine_server_host,
    flags,
    get,
    is_ai_event,
    normalize_host,
    remote_config,
    reset_sessions,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c43122f31894601b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:92 
from posthog.types import (
    FeatureFlag,
    FeatureFlagError,
    FeatureFlagResult,
    FlagMetadata,
    FlagsAndPayloads,
    FlagsResponse,
    FlagValue,
    SendFeatureFlagsOptions,
    normalize_flags_response,
    to_flags_and_payloads,
    to_payloads,
    to_values,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2cdd70fbdc50fc2a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:106 
from posthog.utils import (
    FlagCache,
    RedisFlagCache,
    SizeLimitedDict,
    clean,
    guess_timezone,
    system_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9caa4d800a458d55 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/client.py:114 
from posthog.version import VERSION

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fcccccc8273e1eaf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/consumer.py:7 
from posthog._logging import _configure_posthog_logging

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #bac8fcfc60a824e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/consumer.py:8 
from posthog.capture_compression import CaptureCompression

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #634a4d01232c5416 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/consumer.py:9 
from posthog.capture_mode import CaptureMode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #da770d06412fe89a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/consumer.py:10 
from posthog.capture_v1 import _send_v1_batch

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0b89a0636a71f421 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/consumer.py:11 
from posthog.request import (
    AI_EVENTS_ENDPOINT,
    EVENTS_ENDPOINT,
    APIError,
    DatetimeSerializer,
    batch_post,
    is_ai_event,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a7bb893d8173c191 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/contexts.py:7 
    from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #64ce6f1bd3faa1b7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/exception_capture.py:12 
from posthog.bucketed_rate_limiter import BucketedRateLimiter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9890dc1e55c1f83b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/exception_capture.py:13 
from posthog.exception_utils import walk_exception_chain

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6c1fffe363f79084 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/exception_capture.py:16 
    from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f158da576e00064b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/exception_utils.py:37 
from posthog.args import ExceptionArg, ExcInfo  # noqa: F401

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1c42bf94d34e3e68 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/exception_utils.py:103 
        from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f188a8892e741cd2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/feature_flag_evaluations.py:11 
from posthog.types import FlagValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b95564a352f209e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/feature_flags.py:10 
from posthog import utils

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6fc603b3c0888943 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/feature_flags.py:11 
from posthog.types import FlagValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0ad3a10b649c8e50 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/feature_flags.py:12 
from posthog.utils import convert_to_datetime_aware, is_valid_regex

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7156781ee934a972 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/integrations/celery.py:468 
            from posthog import capture

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #025bf04ae3378d67 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/integrations/celery.py:470 
            capture(event, properties=properties)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #41716f604e9aabbf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/integrations/celery.py:476 
            from posthog import capture_exception

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c2b11e7eeea822eb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/integrations/django.py:368 
            from posthog import capture_exception

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #77c556ec0569e869 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/mcp/__init__.py:29 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e137831ff18b2640 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/mcp/__init__.py:126 
        from posthog import setup

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ee59bad8b93cdac3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/mcp/_exceptions.py:15 
from posthog.exception_utils import exceptions_from_error_tuple

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #116fd2d5c0dabcd7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/mcp/_sink.py:20 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8b8ce37295ff9553 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/mcp/posthog_mcp.py:17 
from posthog.client import Client

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1e32854dc22d4db2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/metrics_capture.py:33 
from posthog.request import _get_session

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f7dc9e2fa5a4b4d5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/metrics_capture.py:34 
from posthog.utils import remove_trailing_slash

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #aeeebfd34e7a8550 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/metrics_capture.py:35 
from posthog.version import VERSION

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d94a2447f4d7b956 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/request.py:18 
from posthog._logging import _configure_posthog_logging

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #cefc61545e423369 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/request.py:19 
from posthog.utils import remove_trailing_slash

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #85669a9b23671519 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/posthog/request.py:20 
from posthog.version import VERSION

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #552f3932259ff69d — Environment-variable access.
pkgs/python/[email protected]/posthog/ai/gemini/gemini.py:190 
                api_key = os.environ.get("GOOGLE_API_KEY") or os.environ.get("API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4f9fe6962173358 — Environment-variable access.
pkgs/python/[email protected]/posthog/ai/gemini/gemini_async.py:191 
                api_key = os.environ.get("GOOGLE_API_KEY") or os.environ.get("API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40ad7eec0e834483 — Environment-variable access.
pkgs/python/[email protected]/posthog/ai/sanitization.py:11 
    return os.environ.get("_INTERNAL_LLMA_MULTIMODAL", "").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #119e291a99b832c1 — Environment-variable access.
pkgs/python/[email protected]/posthog/capture_compression.py:105 
    raw = os.environ.get(CAPTURE_COMPRESSION_ENV_VAR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56009a175dba810c — Environment-variable access.
pkgs/python/[email protected]/posthog/capture_mode.py:70 
    raw = os.environ.get(CAPTURE_MODE_ENV_VAR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #520e7cdb62fef5e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/posthog/capture_v1.py:381 
    return (session or _get_session()).post(
        url, data=body, headers=headers, timeout=timeout
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f5d7e423add596ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/posthog/metrics_capture.py:515 
            response = _get_session().post(
                url,
                data=body,
                headers={
                    "Content-Type": "application/json",
                    "Content-Encoding": "gzip",
                },
                timeout=timeout,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b0a9ed56f1e74751 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/posthog/request.py:246 
    res = (session or _get_session()).post(
        url, data=data, headers=headers, timeout=timeout
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

azure-search-documents

python dependency
medium pii_flow dependency Excluded from app score #30263c03b6594594 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:70 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:70 
    print(f"Retrieved: knowledge source '{knowledge_source.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #eaa861bd91467369 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:127 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:127 
    print(f"Retrieved: knowledge base '{knowledge_base.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #06a76f2f9cb3ea9d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:73 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:73 
    print(f"Retrieved: knowledge source '{knowledge_source.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #bb63a63d4634338e — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:134 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:134 
    print(f"Retrieved: knowledge base '{knowledge_base.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7e56c0c8d5208c4d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication.py:39 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication.py:32 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication.py:39 
    print(f"Document count: {document_count} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5de130ac73bc845e — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication.py:55 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication.py:48 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication.py:55 
    print(f"Indexes ({len(names)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a3f06f255b48af0a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication_async.py:41 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication_async.py:33 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication_async.py:41 
    print(f"Document count: {document_count} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2ba4de06d3aed119 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_authentication_async.py:58 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication_async.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_authentication_async.py:58 
    print(f"Indexes ({len(names)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #d243ea6e4b6b266a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:59 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:59 
    print(f"Uploaded: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #0a6b597cc132f99c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:72 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:72 
    print(f"Merged: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #94d1dec93d79b092 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:87 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:87 
    print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ac77de0f15a968bc — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:100 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:100 
    print(f"Deleted: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #1d5cd6b3ddc5c0a7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud.py:115 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud.py:115 
    print(f"Merge or upload: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #13e64407d984fc08 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:61 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:61 
    print(f"Uploaded: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #fbf8e8d89439ae7d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:77 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:77 
    print(f"Merged: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #16c50d419c8cd06a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:93 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:93 
    print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b803518eeae1b773 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:107 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:107 
    print(f"Deleted: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #53d9118842088ef6 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:123 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:123 
    print(f"Merge or upload: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6ae00232440174b1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:42 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:42 
    print(f"Created: alias '{result.name}' -> index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c2f505c3e871a3ad — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:54 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:54 
    print(f"Retrieved: alias '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #413ec8bcb63b6869 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:108 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:108 
    print(f"Updated: alias '{result.name}' -> index '{new_index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9852d720af6800e6 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:44 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:44 
    print(f"Created: alias '{result.name}' -> index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #38a95597de5db989 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:57 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:57 
    print(f"Retrieved: alias '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ba32f5dc37ae4603 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:112 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:112 
    print(f"Updated: alias '{result.name}' -> index '{new_index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #f8d8ed1b6ab2729d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:43 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_analyze_text.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_analyze_text.py:43 
        print(f"  Token: {token.token}, Start: {token.start_offset}, End: {token.end_offset}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #11b6fb68352cec67 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:45 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:45 
        print(f"  Token: {token.token}, Start: {token.start_offset}, End: {token.end_offset}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #763f0e05058eb359 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:46 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:33 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:46 
    print(f"Response: {response_body}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #173fae5cd041e84d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:51 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:37 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:51 
    print(f"Response: {response_body}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #428cd8d24bd6b047 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:69 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:69 
    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c8c0d5be817bfe2f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:80 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:80 
    print(f"Retrieved: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #46969ce4ce413f6a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:126 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:126 
    print(f"Updated: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2e0e22bdb6ad4ad7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud.py:139 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud.py:139 
        print(f"  - {name}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #708245fa96057210 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:72 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud_async.py:72 
    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #eb2845ee917427b0 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:84 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud_async.py:84 
    print(f"Retrieved: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7cb8dfa1dec73600 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:132 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_crud_async.py:132 
    print(f"Updated: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #67bcdf969373e9fd — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:43 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:43 
    print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #32b6f23beb3dbc74 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:59 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:59 
        print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #baa88be851be9a12 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:71 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:71 
    print(f"Synonym maps ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ab99f835abd78f27 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:85 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:85 
            print(f"  {syn}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #915d65f35e6adf0d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:45 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:45 
    print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a394a0fc26098fc5 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:62 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:62 
        print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #1ed2c30e0d611eb6 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:75 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:75 
    print(f"Synonym maps ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #1610c28da3d546f7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:90 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:90 
            print(f"  {syn}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9b0cd3cb607a09d4 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:74 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:74 
    print(f"Created: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #f09c43fd9456770a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:87 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:87 
    print(f"Indexers ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2c6d9d7404fde2c8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:99 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:99 
    print(f"Retrieved: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #0b11a47b11187493 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:112 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud.py:112 
    print(f"Status: indexer '{indexer_name}' is {status.status}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b023b3dde4427d62 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:80 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:80 
        print(f"Created: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #138c342f3bd58e55 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:94 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:94 
    print(f"Indexers ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a0d4b6887fa78b19 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:107 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:107 
    print(f"Retrieved: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #28366e1ac25dd95b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:121 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:121 
    print(f"Status: indexer '{indexer_name}' is {result.status}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #45e3e67d2a749df5 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:51 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:51 
    print(f"Created: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #bd37fabe16880916 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:64 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:64 
    print(f"Data sources ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #8331b9521a9022c0 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:76 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:76 
    print(f"Retrieved: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a6b3b4a34300b645 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:52 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:52 
    print(f"Created: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b01cdb0d8fd8888a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:66 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:66 
    print(f"Data sources ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b5e19ef60410c905 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:79 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:79 
    print(f"Retrieved: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b0e937db7d8674de — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:119 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:119 
    print(f"Retrieved: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #d9ba1b07ae01c7fe — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:130 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:130 
        print(f"Scheduled: indexer every {updated_indexer.schedule.interval}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #22da9663a36869ca — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:134 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:134 
    print(f"Status: indexer '{updated_indexer.name}' is {status.status}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #d4fbab24998434e9 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:40 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_autocomplete.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_autocomplete.py:40 
        print(f"  Completion: {result['text']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2ca3e3eb164809d0 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:43 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:28 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:43 
            print(f"  Completion: {result['text']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #1d7db0f0b9c73ae2 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_facets.py:43 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_facets.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_facets.py:43 
            print(f"  {facet}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #937607aaa93ae197 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:46 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_facets_async.py:28 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_facets_async.py:46 
                print(f"  {facet}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #03e87403603879d7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_filter.py:45 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_filter.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_filter.py:45 
        print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ea76fbf436cc83f1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:48 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_filter_async.py:28 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_filter_async.py:48 
            print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #4be2c641dd420f15 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:66 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:66 
        print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #06b6f84b24685bd8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:67 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:67 
        print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c6c43e2c88dacd60 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:89 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:89 
        print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #dc30d0eede638870 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic.py:90 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic.py:90 
        print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #33c80672c5873424 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:69 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:69 
            print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #e4606bf888b24c1a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:70 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:70 
            print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #3046efd1fe890bee — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:91 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:91 
            print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9444f2285f14ab8b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:92 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:92 
            print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2f19d29609c3f64a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_session.py:38 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_session.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_session.py:38 
        print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #e28bc7b0b89f3c9b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_session_async.py:40 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_session_async.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_session_async.py:40 
            print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #0d2d972e3b437dae — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_simple.py:38 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_simple.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_simple.py:38 
        print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #e7aca175d7e90df9 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:41 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_simple_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_simple_async.py:41 
            print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #d15cf55c19df8e88 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:39 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_suggestions.py:24 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_suggestions.py:39 
        print(f"  Text: {result['text']!r}, HotelName: {hotel['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #fb7edc19146130a8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:42 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:42 
            print(f"  Text: {result['text']!r}, HotelName: {hotel['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #887ea7c36a6c4b05 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:130 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:130 
    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5cb1a332ea1a2cc8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:148 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:148 
    print(f"Uploaded: {len(result)} documents to index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #359d519ce6f24e9f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:170 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:170 
        print(
            f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, " f"Category: {result.get('Category')}"
        )

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2f76cbc31f082e42 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:196 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:196 
        print(f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, " f"Tags: {result.get('Tags')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #09dfd086d49de87d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:221 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:221 
        print(f"  Score: {score}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5b7a4564315c1c67 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:222 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:222 
        print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #e989275b840e5730 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:223 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:223 
        print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #935dae2ab623f2e1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:224 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:224 
        print(f"  Description: {result.get('Description')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c130465d0b948687 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:225 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:225 
        print(f"  Category: {result.get('Category')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b8054b36267066c4 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector.py:226 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector.py:226 
        print(f"  Tags: {result.get('Tags', 'N/A')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b271cfd98a8c4d42 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:134 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:134 
    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #8f1204e961d45a4f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:153 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:153 
    print(f"Uploaded: {len(result)} documents to index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6b93221528cac7a7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:176 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:176 
            print(
                f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, "
                f"Category: {result.get('Category')}"
            )

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #600e9b213a984184 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:204 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:204 
            print(f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, " f"Tags: {result.get('Tags')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #763db9778d64a5f8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:230 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:230 
            print(f"  Score: {score}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #226b51362b8b1b1a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:231 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:231 
            print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a8be53a19f94fc97 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:232 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:232 
            print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #401338769f94e907 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:233 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:233 
            print(f"  Description: {result.get('Description')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #4024925b337a90b4 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:234 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:234 
            print(f"  Category: {result.get('Category')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ad8ecf1ef8004767 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:235 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_query_vector_async.py:235 
            print(f"  Tags: {result.get('Tags', 'N/A')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #3ab6b592ad502150 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:42 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:25 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:42 
    print(f"Document count: {response_body} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7c7868d60285d654 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:48 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:26 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:48 
    print(f"Document count: {response_body} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 133 low-confidence finding(s)
low env_fs dependency Excluded from app score #8b0e0761d3ba8c0c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:43 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52c82b630b462a97 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:44 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fa19dfa219d97b1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b26e2fc926381fa4 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:44 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f075f6a60bd60540 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:45 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90ca71695e4a66ff — Environment-variable access.
pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bd1d07ad7154fc9 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:30 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6e99a0e0b8be14c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:31 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a74e96edbb8e2db5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:32 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d62fb70bccb6db8 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:47 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44821ec9d7bb16cd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:48 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c1bb681ae605e8c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:63 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd8b831c667e36ac — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:64 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0263d7983c3d43e6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication.py:80 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e002ceb13968f79 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:31 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #434981145254d86a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:32 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2ea2620bdd277a4 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:33 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0e4c086d2f7bb2a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:49 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3dc5a4173c7f555 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:50 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2df83fdcd0bacf8b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:66 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27a8df8a880df7c2 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:67 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #564901d781b0f86d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_authentication_async.py:84 
    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47c64e89a3df4787 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6e4df931ff313a7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78acdf3693390d7e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ba9d29feb2919a0 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7853a8e90ae802d8 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14757156c7668e81 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f17667e0d2f6f0a9 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20ee8c48e8a3b2bf — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afb551b4f8f64e3e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2aa31c454fccc26d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f4c924e20a36661 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4404b155d9d3154c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49938a3d61244826 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aeece13ca4f8a6ca — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #145992c7f7177966 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d362bb4767919e3 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8a1f37cbb1f387c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #548d84d53aec5ef5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dab0688c369e2d0b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49451fe909a60ad3 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32afd940093ffc67 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #110cdcebd9ae4e3b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61f081d21a145701 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:26 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd12594963de95ca — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54314d5e68d8d4de — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:31 
    endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a656720351a41f3a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:32 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #724f28a15228234d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:33 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd896d15789efd90 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:35 
    endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e48409f139eeb74 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:36 
    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46ca4ad89fe32fb2 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:37 
    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #949f787315849385 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7487af0b4fe9f651 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2013032b65177006 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c2c2840e605799c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ae7f3c59319b936 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #419453f9252d9d1a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e12fc29756b5d236 — Filesystem access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:54 
    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef9e41045e8496c2 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d6d0bf2b648780e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbf18051efaa3175 — Filesystem access.
pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:56 
    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc687f21c3b10292 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ad3c075c9a3bdbd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea7ab2d29c9f6f2f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud.py:26 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7144bd77a9f211a — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60e33d039cab8cf8 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bcb64e905b0e3b5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:27 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a014d2d0a536982f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8379617d8e625d27 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75a1f2349f1ed9d7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:26 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fddc2c02ac31b08 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:25 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2793b2a1b5242d5f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2220de56c9009916 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:27 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c90b71a9fa9dd2f1 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f16beb4657cd55cd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1b486549377b207 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_indexer_workflow.py:26 
connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53bcd6ab3b4f6287 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35b5da1233f28e4c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c405fad8ecdbb9b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f69adca4b9c50d75 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64af1f87c37970e6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c50d1bcacb50f9d7 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8e432fa8d86ce87 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #358a939c5db9600b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0aef3ac667f731b4 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15114b18b0138e46 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d74196a842ead0ed — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05eb17eff1a825b3 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_facets_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fb77c7b1e96af70 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d326bdd15fa45e25 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c35a439ab65eb9b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57dd30e171e19157 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:26 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df0f76d78b7d0d34 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:27 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01d392819dfaa9f0 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_filter_async.py:28 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91acd54e95f7adf6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66c46fea10a9e320 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c40b3995a5843305 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f028686800d745ce — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db57c45979071f45 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:24 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8557adde2e1ced92 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65b137f16f42a8fe — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2513c3a9c2487517 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c12e7a42b5a2c23b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #080a7cd561011671 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session_async.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ba30990240356f5 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session_async.py:24 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41b589b11f87b5a8 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_session_async.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fbea4ef1f0bfdd6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3842ce5e6ecc701e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6ea29cb3cc3a62c — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e91db7e01e170998 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3172b3cf65e70151 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c71b99d30016dca6 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_simple_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35fb6db6cc4eea82 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:22 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17a1fd32f61ce132 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:23 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #579bd5e801c97d31 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions.py:24 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb67be894a797929 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3df4abbf438b77d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf4b1a34fbbdf4fd — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ad1701e15940273 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector.py:49 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e4dbce757a19d78 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector.py:50 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6d5d7067cd65e6f — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector.py:60 
    with open(query_vector_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #502062bfc23ef81d — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector.py:134 
    with open(documents_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e53a1166a0c2067 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:51 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7575925f7d2807f — Environment-variable access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a71ddf84baf93150 — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:63 
    with open(query_vector_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ae647f468489c45 — Filesystem access.
pkgs/python/[email protected]/samples/sample_query_vector_async.py:138 
    with open(documents_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f913b930bc063b3b — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:23 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3980cf76fb82b761 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:24 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39c7d8a72a72ed93 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:25 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58a65cfdea8eda7e — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:24 
service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b912c333a0f6965d — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:25 
index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #726be0a548615972 — Environment-variable access.
pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:26 
key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

chromadb

python dependency
medium telemetry dependency Excluded from app score #dd858126e9881e8a — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/rust.py:226 
        self.product_telemetry_client.capture(
            ClientCreateCollectionEvent(
                collection_uuid=str(id),
                # embedding_function=embedding_function.__class__.__name__,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #190d97dcfe21fba4 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/rust.py:429 
        self.product_telemetry_client.capture(
            CollectionGetEvent(
                collection_uuid=str(collection_id),
                ids_count=ids_amount,
                limit=limit if limit else 0,
                include_metadata=ids_amount if "metadatas" in include else 0,
                include_documents=ids_amount if "documents" in include else 0,
                include_uris=ids_amount if "uris" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #02468c270bfca717 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/rust.py:474 
        self.product_telemetry_client.capture(
            CollectionAddEvent(
                collection_uuid=str(collection_id),
                add_amount=len(ids),
                with_metadata=len(ids) if metadatas is not None else 0,
                with_documents=len(ids) if documents is not None else 0,
                with_uris=len(ids) if uris is not None else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c1b7ae7d5d6967f7 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/rust.py:507 
        self.product_telemetry_client.capture(
            CollectionUpdateEvent(
                collection_uuid=str(collection_id),
                update_amount=len(ids),
                with_embeddings=len(embeddings) if embeddings else 0,
                with_metadata=len(metadatas) if metadatas else 0,
                with_documents=len(documents) if documents else 0,
                with_uris=len(uris) if uris else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #85cb6bcd6436551f — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/rust.py:567 
        self.product_telemetry_client.capture(
            CollectionQueryEvent(
                collection_uuid=str(collection_id),
                query_amount=query_amount,
                filtered_ids_amount=filtered_ids_amount,
                n_results=n_results,
                with_metadata_filter=query_amount if where is not None else 0,
                with_document_filter=query_amount if where_document is not None else 0,
                include_metadatas=query_amount if "metadatas" in include else 0,
                include_documents=query_amount if "documents" in include else 0,
                include_uris=query_amount if "uris" in include else 0,
                include_distances=query_amount if "distances" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d2a5a56b20135e07 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/rust.py:626 
        self.product_telemetry_client.capture(
            CollectionDeleteEvent(
                collection_uuid=str(collection_id),
                delete_amount=deleted,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2c18768be88efe0f — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/segment.py:285 
        self._product_telemetry_client.capture(
            ClientCreateCollectionEvent(
                collection_uuid=str(id),
                # embedding_function=embedding_function.__class__.__name__,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #d4f241b50434fd29 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/segment.py:552 
        self._product_telemetry_client.capture(
            CollectionAddEvent(
                collection_uuid=str(collection_id),
                add_amount=len(ids),
                with_metadata=len(ids) if metadatas is not None else 0,
                with_documents=len(ids) if documents is not None else 0,
                with_uris=len(ids) if uris is not None else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3d090006f9979d96 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/segment.py:607 
        self._product_telemetry_client.capture(
            CollectionUpdateEvent(
                collection_uuid=str(collection_id),
                update_amount=len(ids),
                with_embeddings=len(embeddings) if embeddings else 0,
                with_metadata=len(metadatas) if metadatas else 0,
                with_documents=len(documents) if documents else 0,
                with_uris=len(uris) if uris else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4ef145625beb9eff — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/segment.py:714 
        self._product_telemetry_client.capture(
            CollectionGetEvent(
                collection_uuid=str(collection_id),
                ids_count=ids_amount,
                limit=limit if limit else 0,
                include_metadata=ids_amount if "metadatas" in include else 0,
                include_documents=ids_amount if "documents" in include else 0,
                include_uris=ids_amount if "uris" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6ac534b7e232ce11 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/segment.py:825 
        self._product_telemetry_client.capture(
            CollectionDeleteEvent(
                collection_uuid=str(collection_id), delete_amount=deleted_count
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #df9ca3849fdd136d — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/segment.py:890 
        self._product_telemetry_client.capture(
            CollectionQueryEvent(
                collection_uuid=str(collection_id),
                query_amount=query_amount,
                filtered_ids_amount=ids_amount,
                n_results=n_results,
                with_metadata_filter=query_amount if where is not None else 0,
                with_document_filter=query_amount if where_document is not None else 0,
                include_metadatas=query_amount if "metadatas" in include else 0,
                include_documents=query_amount if "documents" in include else 0,
                include_uris=query_amount if "uris" in include else 0,
                include_distances=query_amount if "distances" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #47f208893e195b65 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/api/shared_system_client.py:137 
        telemetry_client.capture(ClientStartEvent())

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8ea031bc3378a1f7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/execution/executor/distributed.py:22 
from opentelemetry.trace import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e5ea8952e6fb078d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/proto/utils.py:4 
from opentelemetry.trace import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b5e45c1df6707e35 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/server/fastapi/__init__.py:77 
from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0f931e795538afda — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.
pkgs/python/[email protected]/chromadb/server/fastapi/__init__.py:245 
        telemetry_client.capture(ServerStartEvent())

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e1912d50496f9e30 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:7 
from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6cf6471eee565134 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:8 
from opentelemetry.sdk.resources import SERVICE_NAME, Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2774563f709e41c3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:9 
from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #e5fad46160a4d6e1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:10 
from opentelemetry.sdk.trace.export import (
    BatchSpanProcessor,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #cd61e04c0ffebce6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:13 
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #1e2538a96755c1ad — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/fastapi.py:3 
from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #956ec567ef5e767b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/grpc.py:5 
from opentelemetry.trace import StatusCode, SpanKind

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 67 low-confidence finding(s)
low env_fs dependency Excluded from app score #4a4ff5e851030f28 — Environment-variable access.
pkgs/python/[email protected]/chromadb/__init__.py:407 
            arg.value = arg.value or os.environ.get(arg.env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1e5a7d93479a231 — Environment-variable access.
pkgs/python/[email protected]/chromadb/__init__.py:420 
    tenant = tenant or os.environ.get("CHROMA_TENANT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1ad2f29c8b85f5b — Environment-variable access.
pkgs/python/[email protected]/chromadb/__init__.py:423 
    database = database or os.environ.get("CHROMA_DATABASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #a9e9cf56cb396dc6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/api/async_fastapi.py:167 
        response = await self._get_client().request(method, url, **cast(Any, kwargs))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8977096aae75e520 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/api/fastapi.py:131 
        response = self._session.request(method, url, **cast(Any, kwargs))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #90ad7c936fb1064e — Filesystem access.
pkgs/python/[email protected]/chromadb/auth/__init__.py:124 
            with open(_creds_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #088503c22e375363 — Filesystem access.
pkgs/python/[email protected]/chromadb/auth/__init__.py:235 
            with open(_config_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #432d55adcc62f283 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/cli/cli.py:25 
        response = requests.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #a1aa57b49e2e7e29 — Filesystem access.
pkgs/python/[email protected]/chromadb/cli/utils.py:12 
    with open(f"{log_config_path}", "r") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d59d1c93d4b0840 — Filesystem access.
pkgs/python/[email protected]/chromadb/db/migrations.py:256 
    sql = file["path"].read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90216ab04f546d6d — Filesystem access.
pkgs/python/[email protected]/chromadb/segment/impl/vector/local_persistent_hnsw.py:74 
        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #010eb43038d723c4 — Filesystem access.
pkgs/python/[email protected]/chromadb/segment/impl/vector/local_persistent_hnsw.py:255 
        with open(self._get_metadata_file(), "wb") as metadata_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4e636b56d51396d — Environment-variable access.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:139 
                        {"pod_name": os.environ.get("HOSTNAME")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64422c7c51158328 — Environment-variable access.
pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:155 
                        {"pod_name": os.environ.get("HOSTNAME")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #201092814643257a — Filesystem access.
pkgs/python/[email protected]/chromadb/telemetry/product/__init__.py:88 
                with open(self.USER_ID_PATH, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46f84ec877656b40 — Filesystem access.
pkgs/python/[email protected]/chromadb/telemetry/product/__init__.py:93 
                with open(self.USER_ID_PATH, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0288aa45c33e340f — Environment-variable access.
pkgs/python/[email protected]/chromadb/telemetry/product/events.py:20 
        self.is_cli = os.environ.get("CHROMA_CLI", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c58ebfd25328c03 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/baseten_embedding_function.py:39 
        if os.getenv("BASETEN_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1edc8ae72f42fcd2 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/baseten_embedding_function.py:45 
        resolved_api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93f4b123bd0087e4 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_qwen_embedding_function.py:61 
        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #b022949d8cb8e29f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_qwen_embedding_function.py:127 
        response = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #569f72d99a03da92 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_qwen_embedding_function.py:149 
        response = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #3282558f4d17af5c — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_splade_embedding_function.py:42 
        self.api_key = os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c29dd764e88298f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_splade_embedding_function.py:99 
            response = self._session.post(self._api_url, json=payload, timeout=60)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #62a0265ec4db53a1 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:57 
        if os.getenv("CLOUDFLARE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e3fb9294b3994c8 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:62 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #afe592b538171d04 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:99 
        resp = self._session.post(self._api_url, json=payload).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #d57b1785e2c58918 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cohere_embedding_function.py:46 
        if os.getenv("COHERE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6dd3f935c825e52 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/cohere_embedding_function.py:51 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8655e160e9f91332 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:57 
        self.api_key = os.getenv(self.api_key_env_var) if self.api_key_env_var else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c31ac7c4ae14758b — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:251 
        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cd867502066af40 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:256 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63b9d39cc7e2c83a — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:401 
        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7458773c319bbbb5 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:406 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #007ca603c9972dcc — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:529 
        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #839db15637026b75 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:534 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f4db29f31e7b6b6 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:43 
        if os.getenv("HUGGINGFACE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83eb10460537afa9 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:48 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #3776e7fac4681f59 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:76 
        response = self._session.post(
            self._api_url,
            json={"inputs": input, "options": {"wait_for_model": True}},
        ).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #cd2392b524e2b1d5 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:169 
        if os.getenv("HUGGINGFACE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ae6cc30e626af34 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:173 
            self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #354fdca44fe37aa8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:199 
        response = self._session.post(self._api_url, json={"inputs": input}).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #ad1500203d3b728d — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:84 
        if os.getenv("JINA_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b137e674d16dccc9 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:89 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c99cce4769b47be1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:202 
        resp = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f7049e1ec4f758e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:210 
        resp = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #47b0629f7b2b1749 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/mistral_embedding_function.py:29 
        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af74f0651d23fc59 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/morph_embedding_function.py:49 
        self.api_key = api_key or os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc61ad725bdffc53 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/nomic_embedding_function.py:50 
        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11a4514ae0133271 — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/onnx_mini_lm_l6_v2.py:24 
    with open(fname, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f453ba18ee4df18 — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/onnx_mini_lm_l6_v2.py:109 
            with open(fname, "wb") as file, self.tqdm(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb01bcf39a235082 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/openai_embedding_function.py:60 
        if os.getenv("OPENAI_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3604148699b7a749 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/openai_embedding_function.py:65 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #141d36875473a218 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/perplexity_embedding_function.py:52 
        if os.getenv("PERPLEXITY_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f745939a67afff31 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/perplexity_embedding_function.py:57 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8255d4429e79e98 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:48 
        if os.getenv("ROBOFLOW_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #784e92e4ce01b2b4 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:53 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #acbe7bfb9ea00c84 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:97 
                res = self._httpx.post(
                    f"{self.api_url}/clip/embed_image?api_key={self.api_key}",
                    json=infer_clip_payload_image,
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9628a7df86424a9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:110 
                res = self._httpx.post(
                    f"{self.api_url}/clip/embed_text?api_key={self.api_key}",
                    json=infer_clip_payload_text,
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #312baa4877850f5f — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/schemas/registry.py:38 
        with open(schema_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #095fda3d2f61f370 — Filesystem access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/schemas/schema_utils.py:36 
    with open(schema_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4782b1b5c2268333 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:52 
        if os.getenv("TOGETHER_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40442561fb4be781 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:57 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9f3916beef5728aa — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:89 
        response = self._session.post(
            ENDPOINT,
            json={"model": self.model_name, "input": input},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #8b185297bb551581 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/utils.py:11 
    return (os.environ.get("CHROMA_EMBED_URL") or DEFAULT_CHROMA_EMBED_URL).rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0199dbf5057af2e4 — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/voyageai_embedding_function.py:50 
        if os.getenv("VOYAGE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #206ebd320d0d138d — Environment-variable access.
pkgs/python/[email protected]/chromadb/utils/embedding_functions/voyageai_embedding_function.py:55 
        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-identity

python dependency
medium pii_flow dependency Excluded from app score #ffcd57faa67bdf22 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:99 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/azure/identity/_credentials/environment.py:66 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/azure/identity/_credentials/environment.py:99 
            _LOGGER.info("Environment is configured for %s", self._credential.__class__.__name__)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7dbf89ad0bd43cd5 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:77 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:60 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:77 
            _LOGGER.info("Environment is configured for %s", self._credential.__class__.__name__)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 105 low-confidence finding(s)
low env_fs dependency Excluded from app score #3203b9a79dedb261 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/app_service.py:22 
    url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb1641f0a537cae1 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/app_service.py:23 
    secret = os.environ.get(EnvironmentVariables.IDENTITY_HEADER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdfaeb889e10e8ee — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azd_cli.py:239 
        path = os.environ.get("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2a8649365d83f1f — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azd_cli.py:322 
            "env": dict(os.environ, NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a043adb177376cb — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_arc.py:52 
    with open(key_file, "r", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb7b9b2d7a8acb72 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_arc.py:74 
        program_data_path = os.environ.get("PROGRAMDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd70dbe0c0f90ee7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_cli.py:240 
        path = os.environ.get("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b128e8b4a16f1db — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_cli.py:278 
            "env": dict(os.environ, AZURE_CORE_NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0653c2503e75ac3f — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_ml.py:23 
    url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51b22f8a540a96ad — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_ml.py:24 
    secret = os.environ.get(EnvironmentVariables.MSI_SECRET)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b0e91cae5bc1cd9 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_pipelines.py:25 
    base_uri = os.environ[SYSTEM_OIDCREQUESTURI].rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0ca67532caabb6c — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/azure_pipelines.py:37 
    if SYSTEM_OIDCREQUESTURI not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ce1ca7b7f5c37a5 — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/certificate.py:149 
        with open(certificate_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cd7fb5d6a95e6f8 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/cloud_shell.py:34 
        url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6cbe2cbffe4bd34 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:154 
            "interactive_browser_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d818cf27b8a02854 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:158 
            "managed_identity_client_id", os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9043d6b34d8f2f50 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:162 
            "workload_identity_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d061645da2b057f — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:166 
        broker_tenant_id = kwargs.pop("broker_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84818901f0be1ae8 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:169 
        shared_cache_username = kwargs.pop("shared_cache_username", os.environ.get(EnvironmentVariables.AZURE_USERNAME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da7d76fbca644203 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:171 
            "shared_cache_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e90c72d56fc324f7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:176 
        token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2ae222376c2fefd — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/default.py:268 
                        token_file_path=os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6b343bc024ff63e — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:63 
        if all(os.environ.get(v) is not None for v in EnvironmentVariables.CLIENT_SECRET_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e5f9178340df8ed — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:65 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3897e9465da100e0 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:66 
                client_secret=os.environ[EnvironmentVariables.AZURE_CLIENT_SECRET],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0215120b232cda9e — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:67 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5881f9988d2068a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:70 
        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.CERT_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ba9b58039b28cd4 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:72 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cedc0ac859d73b1 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:73 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #228cb404a8da55d7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:74 
                certificate_path=os.environ[EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PATH],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74107f523ecdc3e1 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:75 
                password=os.environ.get(EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PASSWORD),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79abcf42684c5c0f — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:77 
                    os.environ.get(EnvironmentVariables.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #771c2776da9f5383 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:81 
        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.USERNAME_PASSWORD_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ecd2687c1382af3 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:83 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3095c3e49f8f25d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:84 
                username=os.environ[EnvironmentVariables.AZURE_USERNAME],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4c10dc9d3822294 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:85 
                password=os.environ[EnvironmentVariables.AZURE_PASSWORD],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff217ef02a40df84 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:86 
                tenant_id=os.environ.get(EnvironmentVariables.AZURE_TENANT_ID),  # optional for username/password auth

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b914e7fb7b65afa — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/environment.py:106 
            set_variables = [v for v in expected_variables if v in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f288f202d95eb744 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/imds.py:60 
        os.environ.get(EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST, IMDS_AUTHORITY).strip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #925dea39e4788fe7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/imds.py:90 
        if EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ee6af6a69c85684 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:82 
        if os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b86a1286f3f89550 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:83 
            if os.environ.get(EnvironmentVariables.IDENTITY_HEADER):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc7dc1dba2aca510 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:84 
                if os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2408415736bfc9d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:98 
            elif os.environ.get(EnvironmentVariables.IMDS_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c2cbc4cbd15d9dd — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:103 
        elif os.environ.get(EnvironmentVariables.MSI_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03564184a09443c2 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:104 
            if os.environ.get(EnvironmentVariables.MSI_SECRET):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c1d3c2f00012d3a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:115 
            all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74d42f4294d4faec — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:120 
            workload_client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b00cc4ab52b83f7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:131 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ad73e5644950653 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:133 
                token_file_path=os.environ[EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39df1191d9b3f0e2 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:42 
    url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d809f661b8236c5 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:43 
    secret = os.environ.get(EnvironmentVariables.IDENTITY_HEADER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aec9c2e50a701c5a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:44 
    thumbprint = os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0bf944af17e79bf — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/vscode.py:50 
            with open(expanded_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9bc27264911010d — Filesystem access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:33 
            with open(self._token_file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb0b30db72b3a9f6 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:79 
        tenant_id = tenant_id or os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c61dc98abfb3203 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:80 
        client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9415cbc3f2a56296 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:81 
        token_file_path = token_file_path or os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75e78dc1f76181e5 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/msal_credentials.py:39 
        self._regional_authority = os.environ.get(EnvironmentVariables.AZURE_REGIONAL_AUTHORITY_NAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a15f4fef8a0576a — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/utils.py:90 
    authority = os.environ.get(EnvironmentVariables.AZURE_AUTHORITY_HOST, KnownAuthorities.AZURE_PUBLIC_CLOUD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4281b4b71edf5b2e — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/utils.py:151 
    if default_tenant == "adfs" or os.environ.get(EnvironmentVariables.AZURE_IDENTITY_DISABLE_MULTITENANTAUTH):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42446faac687c88d — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_internal/utils.py:207 
    token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b100fd669de823b2 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_persistent_cache.py:88 
    if sys.platform.startswith("win") and "LOCALAPPDATA" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40e954ba168aa0fd — Environment-variable access.
pkgs/python/[email protected]/azure/identity/_persistent_cache.py:89 
        cache_location = os.path.join(os.environ["LOCALAPPDATA"], ".IdentityService", cache_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d58c8dbf7b4a2eb — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azd_cli.py:221 
            env=dict(os.environ, NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd0f60dd425f1248 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_arc.py:19 
        url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98b33f9f278cb457 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_arc.py:20 
        imds = os.environ.get(EnvironmentVariables.IMDS_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3c44323478d2b42 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_cli.py:226 
            env=dict(os.environ, AZURE_CORE_NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a30f6ec7f87453d5 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/cloud_shell.py:21 
        url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff4de7f797d9e68f — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:135 
        shared_cache_username = kwargs.pop("shared_cache_username", os.environ.get(EnvironmentVariables.AZURE_USERNAME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61b6ab0ba0a19ebd — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:137 
            "shared_cache_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b0d6d31be0ee050 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:141 
            "managed_identity_client_id", os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47a2473656a77944 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:145 
            "workload_identity_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c60e41f66336ab19 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:150 
        token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57fa115e871ae563 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:231 
                        token_file_path=os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0378c06520f257aa — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:57 
        if all(os.environ.get(v) is not None for v in EnvironmentVariables.CLIENT_SECRET_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cac1d1cb29a227f — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:59 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cbd862d85c5fa95 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:60 
                client_secret=os.environ[EnvironmentVariables.AZURE_CLIENT_SECRET],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e80779ebca3c9f16 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:61 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b37abb35d9a5851 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:64 
        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.CERT_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #617f697119a43526 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:66 
                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af9477498f4c5e3c — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:67 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b0829f06ef9adb7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:68 
                certificate_path=os.environ[EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PATH],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1be26e9ebe0370d0 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:69 
                password=os.environ.get(EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PASSWORD),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9fe0509923d23a7 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:71 
                    os.environ.get(EnvironmentVariables.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb0548301dd64c71 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:80 
            set_variables = [v for v in expected_variables if v in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #927a4000774a6c71 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/imds.py:54 
        if EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5be1eb18fe171bd8 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:54 
        if os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db8c62ebeff84792 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:55 
            if os.environ.get(EnvironmentVariables.IDENTITY_HEADER):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7fe16aa85232c33 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:56 
                if os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #195c24a9e72a4f45 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:70 
            elif os.environ.get(EnvironmentVariables.IMDS_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b63d1323e1c8b7c8 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:75 
        elif os.environ.get(EnvironmentVariables.MSI_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a1d0538b29da450 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:76 
            if os.environ.get(EnvironmentVariables.MSI_SECRET):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0dd0ff2cc225069 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:87 
            all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac4e493fcee88529 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:92 
            workload_client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d78c0a440d1f6a99 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:103 
                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #130138aa1e306312 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:105 
                token_file_path=os.environ[EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #050a2107e3ca1916 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:57 
        tenant_id = tenant_id or os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d60e8b7e9bf5fd49 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:58 
        client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5fe5b2005ee0dad0 — Environment-variable access.
pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:59 
        token_file_path = token_file_path or os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bdac9ac1dc94b24 — Environment-variable access.
pkgs/python/[email protected]/samples/control_interactive_prompts.py:17 
VAULT_URL = os.environ.get("VAULT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68d046a25c0cb9a2 — Environment-variable access.
pkgs/python/[email protected]/samples/credential_creation_code_snippets.py:360 
        system_access_token=os.environ["SYSTEM_ACCESSTOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c99f8fb7e4be8ae8 — Environment-variable access.
pkgs/python/[email protected]/samples/credential_creation_code_snippets.py:374 
        system_access_token=os.environ["SYSTEM_ACCESSTOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bcc12bb5af0faaa — Environment-variable access.
pkgs/python/[email protected]/samples/key_vault_cert.py:19 
VAULT_URL = os.environ["VAULT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b7424cd5e409c77 — Environment-variable access.
pkgs/python/[email protected]/samples/user_authentication.py:14 
VAULT_URL = os.environ.get("VAULT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

databricks-sdk

python dependency
medium pii_flow dependency Excluded from app score #2075505e979d7bff — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:343 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:340 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:343 
        headers={"Authorization": f"Bearer {token.access_token}"},

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #2322e27b186c08e6 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:23 · flow /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:21 → /tmp/closeopen-wiuwd3vh/pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:23 
        response = requests.get(endpoint, headers=headers)

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 60 low-confidence finding(s)
low egress dependency Excluded from app score #785f7238dfd9d2d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/_base_client.py:284 
        response = self._session.request(
            method,
            url,
            params=self._fix_query_string(query),
            json=body,
            headers=headers,
            files=files,
            data=data,
            auth=auth,
            stream=raw,
            timeout=self._http_timeout_seconds,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #544817bffe7ee41b — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/config.py:565 
            if attr.env and os.environ.get(attr.env):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d165383df1d05b1 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/config.py:569 
                    if os.environ.get(alias):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #054cd0ff2339a657 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/config.py:602 
            response = requests.get(f"{self.host}/api/2.0/preview/scim/v2/Me", headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d9bed5e6d41bba0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/config.py:698 
        resp = requests.get(login_url, allow_redirects=False)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #de7203b098441d2d — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/config.py:731 
            value = os.environ.get(attr.env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b16eac3d95605ee — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/config.py:734 
                    value = os.environ.get(alias)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb6664797df32520 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:159 
    if "DATABRICKS_RUNTIME_VERSION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fcb813aec8b19b8 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:203 
    if "DATABRICKS_RUNTIME_VERSION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #8fad15a309e5b35a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:341 
    resp = requests.get(
        f"{arm}{cfg.azure_workspace_resource_id}?api-version=2018-04-01",
        headers={"Authorization": f"Bearer {token.access_token}"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #2d79cf49f37151a7 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:538 
    if "ACTIONS_ID_TOKEN_REQUEST_TOKEN" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5c21a76f2116795 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:593 
        with io.open(cfg.google_credentials, "r", encoding="utf-8") as json_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44466564aa7f6d74 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:1195 
        for dir in os.getenv("PATH", default="").split(os.path.pathsep):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #82545be3c3d3d15d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:1264 
        resp = requests.get(
            self.url,
            timeout=self._metadata_service_timeout,
            headers={
                self.METADATA_SERVICE_VERSION_HEADER: self.METADATA_SERVICE_VERSION,
                self.METADATA_SERVICE_HOST_HEADER: self.host,
            },
            proxies={
                # Explicitly exclude localhost from being proxied. This is necessary
                # for Metadata URLs which typically point to localhost.
                "no_proxy": "localhost,127.0.0.1"
            },
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #5b5701e0159b9155 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:1329 
            os.environ.get("IS_IN_DB_MODEL_SERVING_ENV")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5182838f7c9512d9 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:1330 
            or os.environ.get("IS_IN_DATABRICKS_MODEL_SERVING_ENV")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #145ab20b667e50f2 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:1343 
            with open(ModelServingAuthProvider._MODEL_DEPENDENCY_OAUTH_TOKEN_FILE_PATH) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72596887347ca444 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/credentials_provider.py:1379 
        host = os.environ.get("DATABRICKS_MODEL_SERVING_HOST_URL") or os.environ.get("DB_MODEL_SERVING_HOST_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #590edb3d8b952b5c — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/dbutils.py:275 
    value = os.getenv("DATABRICKS_SOURCE_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #f887485238c4b8ba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1017 
            response = session.request(
                "HEAD",
                probe_url,
                headers=headers,
                timeout=self._STORAGE_PROXY_PROBE_TIMEOUT,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #df77ea0d257e5a28 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1165 
        with open(destination, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0216ef7e74f1c37 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1204 
                    with open(temp_file, "r+b") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67edecf0dee4520c — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1505 
            with open(source_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afd6370a8b39b9d7 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1654 
                with open(ctx.source_file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10915af3424ab2b5 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1669 
            with open(ctx.source_file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51ab70ce2a4795ed — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1694 
        with open(ctx.source_file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b067eadabafd247 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1883 
                with open(part.ctx.source_file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #33ad5f47b5ca4ad1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:1971 
                return self._cloud_provider_session().request(
                    "PUT",
                    presigned.url,
                    headers=presigned.headers,
                    data=part_content,
                    timeout=self._config.files_ext_network_transfer_inactivity_timeout_seconds,
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e64d6197fba8aba0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:2079 
                    return self._cloud_provider_session().request(
                        "PUT",
                        presigned.url,
                        headers=presigned.headers,
                        data=chunk,
                        timeout=self._config.files_ext_network_transfer_inactivity_timeout_seconds,
                    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b8bcd62ea3dc0f59 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:2284 
                        return self._cloud_provider_session().request(
                            "PUT",
                            resumable_upload_url,
                            headers={"Content-Range": "bytes */*"},
                            data=b"",
                            timeout=self._config.files_ext_network_transfer_inactivity_timeout_seconds,
                        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c2dc611ec7739b1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:2299 
                    upload_response = self._cloud_provider_session().request(
                        "PUT",
                        resumable_upload_url,
                        headers=headers,
                        data=BytesIO(buffer[:actual_chunk_length]),
                        timeout=self._config.files_ext_network_transfer_inactivity_timeout_seconds,
                    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #73c68665074f1784 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:2434 
            return self._cloud_provider_session().request(
                "DELETE",
                abort_info.url,
                headers=abort_info.headers,
                data=b"",
                timeout=self._config.files_ext_network_transfer_inactivity_timeout_seconds,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dc439eedd678c8c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:2451 
            return self._cloud_provider_session().request(
                "DELETE",
                resumable_upload_url,
                headers=headers,
                data=b"",
                timeout=self._config.files_ext_network_transfer_inactivity_timeout_seconds,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #abafd2e0626fde52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/mixins/files.py:2612 
            return self._cloud_provider_session().request(
                "GET",
                url_and_headers.url,
                headers=merged_headers,
                timeout=self._config.files_ext_network_transfer_inactivity_timeout_seconds,
                stream=True,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8efe5f2c0366e061 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/oauth.py:209 
    resp = requests.post(token_url, params, auth=auth, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #28fb32ebd3f3b650 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/oauth.py:548 
    res = requests.get(f"{host}/oidc/oauth2/v2.0/authorize", allow_redirects=False)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6d959182e8765f91 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/oauth.py:916 
        resp = requests.post(token_exchange_url, params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #de1998b8881b3af6 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/oauth.py:980 
            with open(self.filename, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a32f4d4cc77c451 — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/oauth.py:997 
        with open(self.filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f2c160ea728f857 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc.py:78 
        token = os.getenv(self.env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #088def8011cf52ec — Filesystem access.
pkgs/python/[email protected]/databricks/sdk/oidc.py:114 
            with open(self.path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a771176893566209 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:17 
        if "ACTIONS_ID_TOKEN_REQUEST_TOKEN" not in os.environ or "ACTIONS_ID_TOKEN_REQUEST_URL" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a100bc65093f2b90 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:21 
        headers = {"Authorization": f"Bearer {os.environ['ACTIONS_ID_TOKEN_REQUEST_TOKEN']}"}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e871a7efe1738b8a — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:22 
        endpoint = f"{os.environ['ACTIONS_ID_TOKEN_REQUEST_URL']}&audience={audience}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #dcd89be4488db511 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:23 
        response = requests.get(endpoint, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #22eaebfb4f97cb43 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:46 
        self.access_token = os.environ.get("SYSTEM_ACCESSTOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd5f2d9f2683ce78 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:47 
        self.collection_uri = os.environ.get("SYSTEM_TEAMFOUNDATIONCOLLECTIONURI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1cde7c9d6c8099d — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:48 
        self.project_id = os.environ.get("SYSTEM_TEAMPROJECTID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5321bee86dd55134 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:49 
        self.plan_id = os.environ.get("SYSTEM_PLANID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b942b7ff0695d082 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:50 
        self.job_id = os.environ.get("SYSTEM_JOBID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #095bf1be10baa0db — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:51 
        self.hub_name = os.environ.get("SYSTEM_HOSTTYPE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #4e853b7dc47d48fc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/databricks/sdk/oidc_token_supplier.py:93 
            response = requests.post(endpoint, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #3d364428ea1e58dc — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:119 
    product = os.getenv("DATABRICKS_SDK_UPSTREAM")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #adf414e489694a79 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:120 
    version = os.getenv("DATABRICKS_SDK_UPSTREAM_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4e050058f29063a — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:128 
    if "DATABRICKS_RUNTIME_VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a27c6e3b2f23a1e — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:129 
        runtime_version = os.environ["DATABRICKS_RUNTIME_VERSION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5502c638b5c88d0f — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:222 
            v = os.getenv(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4dd118fe98c013ab — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:312 
    matches = [a.product for a in _KNOWN_AGENTS if a.env_var in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1faa058bdd62dde — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:332 
    v = os.environ.get("AGENT") or os.environ.get("AI_AGENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c8dc4462154b979 — Environment-variable access.
pkgs/python/[email protected]/databricks/sdk/useragent.py:362 
    matches = [h.product for h in _KNOWN_META_HARNESSES if h.env_var in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@upstash/vector

python dependency
expand_more 1 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #d1f1f6ff371b9076 — Environment-variable access.
pkgs/python/@[email protected]__reposrc/.github/scripts/npm_retention.py:11 
NPM_TOKEN = os.environ.get("NPM_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

boto3

python dependency
expand_more 4 low-confidence finding(s)
low env_fs tooling reachable #abe38d9ef680ca30 — Filesystem access.
pkgs/python/[email protected]/boto3/docs/__init__.py:50 
        with open(service_doc_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #67b7c64c9528f4b5 — Filesystem access.
pkgs/python/[email protected]/boto3/docs/service.py:200 
            with open(examples_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7688fd4da5b54c8 — Filesystem access.
pkgs/python/[email protected]/setup.py:24 
    init = open(os.path.join(ROOT, 'boto3', '__init__.py')).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #482732427a6744ae — Filesystem access.
pkgs/python/[email protected]/setup.py:32 
    long_description=open('README.rst').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cassandra-driver

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #0dbdd6840397e833 — Environment-variable access.
pkgs/python/[email protected]/cassandra/cqlengine/management.py:544 
    if not os.getenv(CQLENG_ALLOW_SCHEMA_MANAGEMENT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc70daae1bb99142 — Filesystem access.
pkgs/python/[email protected]/cassandra/datastax/cloud/__init__.py:113 
    with open(path, 'r') as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #5ccde0a7f1ec1927 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/cassandra/datastax/cloud/__init__.py:139 
        response = urlopen(url, context=config.ssl_context, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #35a15c37da24b689 — Filesystem access.
pkgs/python/[email protected]/setup.py:66 
with open(pyproject_toml,"rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #ec9c650c31cc6f59 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:34 
        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29ba27b95eb8ef4d — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:35 
            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7685e41aa73f4054 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:36 
        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16e1740ba13531f1 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:37 
            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

python dependency
expand_more 69 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #bb62f7015e42521b — Filesystem access.
pkgs/python/[email protected]/examples/image_stream.py:30 
            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c52c7151021ca50b — Filesystem access.
pkgs/python/[email protected]/examples/image_stream.py:41 
            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #93b49b17194b07d4 — Environment-variable access.
pkgs/python/[email protected]/examples/realtime/azure_realtime.py:31 
    endpoint = os.environ["AZURE_OPENAI_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #49088087fec13b9b — Environment-variable access.
pkgs/python/[email protected]/examples/realtime/azure_realtime.py:37 
    deployment_name = os.environ["AZURE_OPENAI_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #873f65f7848c640d — Filesystem access.
pkgs/python/[email protected]/examples/uploads.py:30 
    data = file.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #452d7fd5a0fdad40 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:158 
api_type: _ApiType | None = _t.cast(_ApiType, _os.environ.get("OPENAI_API_TYPE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e774398ee31f815d — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:160 
api_version: str | None = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95d8805e9d046afa — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:162 
azure_endpoint: str | None = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8aae197913ca5693 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:164 
azure_ad_token: str | None = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af58f662a487c8ab — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:338 
    return _os.environ.get("OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ead29e467491d6c — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:342 
    return azure_endpoint is not None or _os.environ.get("AZURE_OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26a66a42322f34ac — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:347 
        _os.environ.get("AZURE_OPENAI_AD_TOKEN") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25ba4f0b71fa9767 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:363 
            azure_endpoint = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c95efc4cfb2ce992 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:366 
            azure_ad_token = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68833155595f9aa9 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:369 
            api_version = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #682c9819df7bb880 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:379 
            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f85d3cc38929508 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:379 
            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(
                "AZURE_OPENAI_API_KEY"
            ) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #8c72ef74b4005320 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/src/openai/_base_client.py:309 
        return await self._client.request(self._page_cls, self._options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #a99fe4bf171f2738 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:209 
                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8c1008f7dff0193 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:219 
            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80ad2a0824499f93 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:235 
            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ab002269fe1814c — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:239 
            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #158bec18fd7c834e — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:243 
            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bf4ccf620766d9f — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:251 
            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c43cdfb55615fdde — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:255 
        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f31388b60b857820 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:805 
                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3064eae9bb2b2d56 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:815 
            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24d2d86a46ef9522 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:831 
            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3067f5dafa6d0e1 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:835 
            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d724d049884a6cac — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:839 
            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2104ed0387ebd24 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:847 
            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37ea4a330613f69a — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:851 
        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #310d64e293c9384a — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:69 
            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55aeb2c34c1bfb5a — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:81 
        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdbe561a5c4de004 — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:111 
            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af60ea0cafb2fc36 — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:123 
        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d080ef610ff3e7f5 — Filesystem access.
pkgs/python/[email protected]/src/openai/_legacy_response.py:441 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de299bad3af11598 — Filesystem access.
pkgs/python/[email protected]/src/openai/_legacy_response.py:454 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77cd67d7c0c873b3 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_models.py:129 
            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4023f6dea9086f7 — Filesystem access.
pkgs/python/[email protected]/src/openai/_response.py:513 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce860e7916b48d93 — Filesystem access.
pkgs/python/[email protected]/src/openai/_response.py:555 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2450643948d9942c — Environment-variable access.
pkgs/python/[email protected]/src/openai/_utils/_logs.py:23 
    env = os.environ.get("OPENAI_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ef2de0977a3aa2d — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_transform.py:248 
            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41291b90491688e0 — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_transform.py:414 
            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28e14ceccf0d8b1f — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_utils.py:383 
    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f35bf67351f21a2 — Filesystem access.
pkgs/python/[email protected]/src/openai/auth/_workload.py:58 
            with open(token_file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #1752f4181fe61cd2 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/openai/auth/_workload.py:106 
                response = http_client.get(url, params=params, headers={"Metadata": "true"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ba71775477e516e0 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/openai/auth/_workload.py:109 
                    response = client.get(url, params=params, headers={"Metadata": "true"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f12c7c5f17798e0d — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/openai/auth/_workload.py:153 
                response = http_client.get(url, params=params, headers={"Metadata-Flavor": "Google"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9d306e668dbca0e0 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/openai/auth/_workload.py:156 
                    response = client.get(url, params=params, headers={"Metadata-Flavor": "Google"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #690f8b1050de8983 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/src/openai/auth/_workload.py:249 
            response = client.post(
                self.token_exchange_url,
                json={
                    "grant_type": TOKEN_EXCHANGE_GRANT_TYPE,
                    "subject_token": subject_token,
                    "subject_token_type": subject_token_type,
                    "identity_provider_id": self.workload_identity["identity_provider_id"],
                    "service_account_id": self.workload_identity["service_account_id"],
                },
                timeout=10.0,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #892a6773651fbaab — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/_bedrock_auth.py:172 
        region = os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18981218759c3499 — Filesystem access.
pkgs/python/[email protected]/src/openai/lib/_validators.py:485 
                with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #665c374dd5baff70 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:214 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2217e1a1207f594a — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:217 
            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6080f7bfdbd16a46 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:225 
            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1bb8858879518560 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:239 
                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edf7711e788c0fb8 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:538 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ba6ca4044b812f8 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:541 
            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #421240eee2718025 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:549 
            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83266c15cd8461b3 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:563 
                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #023af70074c9d0ff — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:70 
    configured = region or os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d2b6ebbfedb0960 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:80 
    environment_base_url = os.environ.get("AWS_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd8760733b001522 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:105 
    token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #891e47ac72d652e3 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:150 
    environment_token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fea9d909ca449197 — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:248 
            token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc66c682aaeb5181 — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:331 
            os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6572116581a35ce3 — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:338 
        environment_base_url = _normalize_optional_string(os.environ.get("AWS_BEDROCK_BASE_URL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5673bb067dcfeb9f — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:391 
        and bool(os.environ.get("AWS_BEARER_TOKEN_BEDROCK"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pinecone

python dependency
expand_more 94 low-confidence finding(s)
low env_fs dependency Excluded from app score #dc8ee4a3fac916fd — Environment-variable access.
pkgs/python/[email protected]/pinecone/__init__.py:212 
if _os.environ.get("PINECONE_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c5abe33f28af5f6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/_client.py:529 
        response = self._http.post(f"/backups/{backup_id}/create-index", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #b8a49ef798293cf8 — Environment-variable access.
pkgs/python/[email protected]/pinecone/_internal/config.py:60 
    raw = os.environ.get("PINECONE_ADDITIONAL_HEADERS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #554fe3e01d183f66 — Environment-variable access.
pkgs/python/[email protected]/pinecone/_internal/config.py:159 
            env_key = os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2547e8a78a6619fa — Environment-variable access.
pkgs/python/[email protected]/pinecone/_internal/config.py:162 
            env_host = os.environ.get("PINECONE_CONTROLLER_HOST", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abd61ca326f4e598 — Environment-variable access.
pkgs/python/[email protected]/pinecone/_internal/http_client.py:109 
    if not os.environ.get("PINECONE_DEBUG_CURL"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #33377d63221000d2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/_internal/http_client.py:515 
            response = self._client.get(path, timeout=effective_timeout, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #19d857dff96d5e47 — Environment-variable access.
pkgs/python/[email protected]/pinecone/_internal/http_client.py:535 
            if os.environ.get("PINECONE_DEBUG_CURL"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9da802a27d022f60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/_internal/http_client.py:619 
            response = self._client.put(path, timeout=effective_timeout, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cdb8452ca82770a4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/_internal/http_client.py:772 
            response = await self._ensure_client().post(
                path, timeout=effective_timeout, **_prepare_json_kwargs(kwargs)
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b8d37b646a1e8201 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/_internal/http_client.py:788 
            response = await self._ensure_client().put(
                path, timeout=effective_timeout, **_prepare_json_kwargs(kwargs)
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #674682855c4040c7 — Environment-variable access.
pkgs/python/[email protected]/pinecone/admin/admin.py:103 
        resolved_id = client_id or os.environ.get("PINECONE_CLIENT_ID", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4870c9a4726b93b8 — Environment-variable access.
pkgs/python/[email protected]/pinecone/admin/admin.py:104 
        resolved_secret = client_secret or os.environ.get("PINECONE_CLIENT_SECRET", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #bb1dc5a1e4937770 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/admin/admin.py:194 
                response = client.post(
                    _OAUTH_URL,
                    content=body,
                    headers={
                        "Content-Type": "application/json",
                        "User-Agent": build_user_agent(__version__, source_tag),
                        API_VERSION_HEADER: ADMIN_API_VERSION,
                    },
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eb3363b89b5ffcd9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/admin/api_keys.py:79 
        response = self._http.get(f"/admin/projects/{project_id}/api-keys")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #43814dcb1ad06526 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/admin/api_keys.py:134 
        response = self._http.post(f"/admin/projects/{project_id}/api-keys", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #86bc69bd5ea22135 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/admin/api_keys.py:161 
        response = self._http.get(f"/admin/api-keys/{api_key_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e4364bdc0764f331 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/admin/organizations.py:82 
        response = self._http.get(f"/admin/organizations/{organization_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b6adbef4146a32e1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/admin/projects.py:141 
        response = self._http.get(f"/admin/projects/{project_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #4ddf69f6e8181d04 — Environment-variable access.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:85 
        env_control_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_CONTROL_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06ffc22ac6e4bf0f — Environment-variable access.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:105 
        env_data_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_DATA_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #baebf663cbdcf43c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:325 
        response = await self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ccf3487c40c13eae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:639 
        response = await data_http.get(f"/files/{assistant_name}/{file_id}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e273adfd7b51393f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:714 
        response = await list_http.get(f"/files/{assistant_name}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #69aedeb23563cbda — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:781 
            response = await data_http.get(f"/files/{assistant_name}/{file_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4a2562011578d7d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:854 
            response = await upsert_http.get(f"/operations/{assistant_name}/{operation_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #f837107c2d77c58b — Filesystem access.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:948 
            handle = io.BytesIO(await anyio.Path(file_path).read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #6ee62a0e75213375 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:980 
            upsert_response = await upsert_http.put(
                f"/files/{assistant_name}/{file_id}",
                files=upsert_files,
                params=upsert_query,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a6469d02c77dcaa1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:995 
        response = await data_http.post(
            f"/files/{assistant_name}",
            files={"file": (upload_name, handle)},
            params=params,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5a24057bd3737b15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:1173 
        response = await http.post(f"/chat/{assistant_name}/context", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fbc4a837bb8bd988 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:1295 
        response = await data_http.post(f"/chat/{assistant_name}", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a94fcefc7b7b1f27 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:1448 
        response = await data_http.post(f"/chat/{assistant_name}/chat/completions", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37948d4c7dd2d490 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/assistants.py:1543 
            response = await self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #0692e78c74821324 — Environment-variable access.
pkgs/python/[email protected]/pinecone/async_client/async_index.py:103 
        resolved_key = api_key or os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #16cac6070d4db7b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/async_index.py:224 
        response = await self._http.post(
            f"/records/namespaces/{namespace}/upsert",
            timeout=timeout,
            content=ndjson_body.encode("utf-8"),
            headers={"Content-Type": "application/x-ndjson"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f894e570f766a1f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/async_index.py:1063 
        response = await self._http.post(
            f"/records/namespaces/{namespace}/search", timeout=timeout, json=body
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e0a12d25109e2413 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/async_index.py:1327 
        response = await self._http.get(f"/namespaces/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e2414acc3681904 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/async_index.py:1588 
        response = await self._http.get(f"/bulk/imports/{str_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f7f30c983c8f372c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/backups.py:97 
        response = await self._http.post(f"/indexes/{index_name}/backups", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37ce0c904aa0418b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/backups.py:157 
        response = await self._http.get(path, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3182a827bf53314 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/backups.py:188 
        response = await self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3119ed8ccb48ccaf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/collections.py:127 
        response = await self._http.get(f"/collections/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d8da3930e108933e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/indexes.py:128 
        response = await self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9810795a23c408af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/inference.py:400 
        response = await self._http.get(f"/models/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dc52fd0d51d272e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/pinecone.py:431 
        response = await self._http.post(f"/backups/{backup_id}/create-index", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21274989cb7cb43f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/async_client/restore_jobs.py:122 
        response = await self._http.get(f"/restore-jobs/{job_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #7360bdfcf4ef1f83 — Environment-variable access.
pkgs/python/[email protected]/pinecone/client/assistants.py:82 
        env_control_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_CONTROL_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79fd519e79476b07 — Environment-variable access.
pkgs/python/[email protected]/pinecone/client/assistants.py:102 
        env_data_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_DATA_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #b122363c399a08d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:237 
            response = upsert_http.get(f"/operations/{assistant_name}/{operation_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #b0dd2781e6b7026a — Filesystem access.
pkgs/python/[email protected]/pinecone/client/assistants.py:320 
            opened_file = open(file_path, "rb")  # noqa: SIM115

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #795132258a097af6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:354 
                upsert_response = upsert_http.put(
                    f"/files/{assistant_name}/{file_id}",
                    files=upsert_files,
                    params=upsert_query,
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f201f99430249681 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:367 
            response = data_http.post(
                f"/files/{assistant_name}",
                files={"file": (upload_name, handle)},
                params=params,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8f94747b4842a840 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:398 
            response = data_http.get(f"/files/{assistant_name}/{file_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b89a03740e215189 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:450 
        response = data_http.get(f"/files/{assistant_name}/{file_id}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b81b697acafedd72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:566 
        response = list_http.get(f"/files/{assistant_name}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9dd4d174cd89cee7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:783 
        response = self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #78ec8ab070ea0021 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:1139 
        response = http.post(f"/chat/{assistant_name}/context", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ce38998b81908897 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:1251 
        response = http.post(f"/chat/{assistant_name}", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6df5f2b93b3f5226 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:1343 
        response = http.post(f"/chat/{assistant_name}/chat/completions", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3b096f8b641498d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/assistants.py:1482 
            response = self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #082f2ba053aa7570 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/backups.py:87 
        response = self._http.post(f"/indexes/{index_name}/backups", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #32a682b0d90b91ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/backups.py:137 
        response = self._http.get(path, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f148bdd4dbf39717 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/backups.py:165 
        response = self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c37535e038f1186 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/collections.py:125 
        response = self._http.get(f"/collections/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a7fba5463bf447f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/indexes.py:124 
        response = self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9be18cb38eea085b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/inference.py:409 
        response = self._http.get(f"/models/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #20df1912793a39d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/client/restore_jobs.py:111 
        response = self._http.get(f"/restore-jobs/{job_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #3df08458efabf351 — Environment-variable access.
pkgs/python/[email protected]/pinecone/config/pinecone_config.py:32 
    raw = os.environ.get("PINECONE_ADDITIONAL_HEADERS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d8f59f456744ab8 — Environment-variable access.
pkgs/python/[email protected]/pinecone/config/pinecone_config.py:75 
            host = os.environ.get("PINECONE_CONTROLLER_HOST", _DEFAULT_HOST)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03cbe204a2beec59 — Environment-variable access.
pkgs/python/[email protected]/pinecone/grpc/__init__.py:201 
        resolved_key = api_key or os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #0a42b54495a44328 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/grpc/__init__.py:1388 
        response = self._http.post(
            f"/records/namespaces/{namespace}/upsert",
            timeout=timeout,
            content=ndjson_body.encode("utf-8"),
            headers={"Content-Type": "application/x-ndjson"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #82c9aa4ad7ab8639 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/grpc/__init__.py:1512 
        response = self._http.post(
            f"/records/namespaces/{namespace}/search", timeout=timeout, json=body
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b0b99950d1cd4d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/grpc/__init__.py:1872 
        response = self._http.get(f"/bulk/imports/{str_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #ac185a7a834e7f13 — Environment-variable access.
pkgs/python/[email protected]/pinecone/index/__init__.py:112 
        resolved_key = api_key or os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #57daed47b770427d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/index/__init__.py:550 
        response = self._http.post(
            f"/records/namespaces/{namespace}/upsert",
            timeout=timeout,
            content=ndjson_body.encode("utf-8"),
            headers={"Content-Type": "application/x-ndjson"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f996528cc0398469 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/index/__init__.py:1210 
        response = self._http.post(
            f"/records/namespaces/{namespace}/search", timeout=timeout, json=body
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e9a4aacd2e37e274 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/index/__init__.py:1341 
        response = self._http.get(f"/namespaces/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f24f0892ab33d448 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/index/__init__.py:1689 
        response = self._http.get(f"/bulk/imports/{str_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e1746e95602eaf5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_documents.py:220 
        response = await http.post(
            f"/namespaces/{namespace}/documents/upsert",
            json={"documents": documents},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3ca8d026f883818a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_documents.py:401 
        response = await http.post(
            f"/namespaces/{namespace}/documents/search",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b01de577ca52f803 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_documents.py:465 
        response = await http.post(
            f"/namespaces/{namespace}/documents/fetch",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bc008fcbeacd9db9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_documents.py:536 
        await http.post(
            f"/namespaces/{namespace}/documents/delete",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #263a631e816aceef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_indexes.py:395 
        response = await self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a661108fbc979d05 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_indexes.py:622 
        response = await self._http.post(
            f"/indexes/{index_name}/backups",
            content=content,
            headers={"Content-Type": "application/json"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eae0d85f17e488d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_indexes.py:688 
            response = await self._http.get(f"/indexes/{index_name}/backups", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #167b2becc5c3a87a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/async_indexes.py:730 
        response = await self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f529bbe8efe2a8f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/documents.py:202 
        response = self._http.post(
            f"/namespaces/{namespace}/documents/upsert",
            json={"documents": documents},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d994eca765542665 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/documents.py:376 
        response = self._http.post(
            f"/namespaces/{namespace}/documents/search",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2257caa5a859b4ba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/documents.py:436 
        response = self._http.post(
            f"/namespaces/{namespace}/documents/fetch",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b992ba5388da4e35 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/documents.py:501 
        self._http.post(
            f"/namespaces/{namespace}/documents/delete",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #868baaffd72c0d7e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/indexes.py:378 
        response = self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b38a7c558c867747 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/indexes.py:609 
        response = self._http.post(
            f"/indexes/{index_name}/backups",
            content=content,
            headers={"Content-Type": "application/json"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca4fbf69bac7cd23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/indexes.py:674 
            response = self._http.get(f"/indexes/{index_name}/backups", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #36796bdfed9fd6b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone/preview/indexes.py:716 
        response = self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pinecone-text

python dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #b901b59c59343656 — Environment-variable access.
pkgs/python/[email protected]/pinecone_text/dense/jina_encoder.py:30 
            api_key = os.environ.get("JINA_API_KEY", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #4b7d4c15d91a89e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone_text/dense/jina_encoder.py:69 
        resp = self._session.post(  # type: ignore
            JINA_API_URL, json={"input": texts_input, "model": self._model_name}
        ).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #c451e93329c02045 — Filesystem access.
pkgs/python/[email protected]/pinecone_text/sparse/bm25_encoder.py:170 
        with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #262129e547776c80 — Filesystem access.
pkgs/python/[email protected]/pinecone_text/sparse/bm25_encoder.py:180 
        with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #4cfb736c4d5516ce — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/pinecone_text/sparse/bm25_encoder.py:261 
            response = requests.get(url, stream=True)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #8d48b1b159082bf2 — Filesystem access.
pkgs/python/[email protected]/pinecone_text/sparse/bm25_encoder.py:263 
            with open(tmp_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

protobuf

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #0e59bcd615089bef — Environment-variable access.
pkgs/python/[email protected]/google/protobuf/internal/api_implementation.py:65 
_implementation_type = os.getenv('PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION',
                                 _implementation_type)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db91932157880da3 — Environment-variable access.
pkgs/python/[email protected]/google/protobuf/runtime_version.py:71 
  disable_flag = os.getenv('TEMPORARILY_DISABLE_PROTOBUF_VERSION_CHECK')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eccac0019e2d6bd1 — Filesystem access.
pkgs/python/[email protected]/setup.py:28 
  with open(os.path.join('google', 'protobuf', '__init__.py')) as version_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

psycopg

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #0f9ef26037501e71 — Environment-variable access.
pkgs/python/[email protected]/psycopg/_conninfo_utils.py:81 
    if (env := os.environ.get(paramdef.envvar)) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ebf53c607a709c7 — Environment-variable access.
pkgs/python/[email protected]/psycopg/_dns.py:138 
        if params.get("hostaddr", os.environ.get("PGHOSTADDR", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3aa583c5c4e21795 — Environment-variable access.
pkgs/python/[email protected]/psycopg/_dns.py:141 
        host_arg: str = params.get("host", os.environ.get("PGHOST", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7676ecbec5ca9d7 — Environment-variable access.
pkgs/python/[email protected]/psycopg/_dns.py:143 
        port_arg: str = str(params.get("port", os.environ.get("PGPORT", "")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7554b74225ba65f5 — Environment-variable access.
pkgs/python/[email protected]/psycopg/pq/__init__.py:61 
    impl = os.environ.get("PSYCOPG_IMPL", "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1d5afe8dd192415 — Filesystem access.
pkgs/python/[email protected]/psycopg/pq/_pq_ctypes.py:807 
    with open(fn) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #754f2e90f4b18965 — Filesystem access.
pkgs/python/[email protected]/psycopg/pq/_pq_ctypes.py:838 
    with open(fn, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c5ac45a0a9ce5f1 — Environment-variable access.
pkgs/python/[email protected]/psycopg/waiting.py:437 
if "PSYCOPG_WAIT_FUNC" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04f63288d412c685 — Environment-variable access.
pkgs/python/[email protected]/psycopg/waiting.py:438 
    fname = os.environ["PSYCOPG_WAIT_FUNC"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pydantic

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #e2f97de30f51dabc — Filesystem access.
pkgs/python/[email protected]/pydantic/deprecated/parse.py:71 
    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb81e57af31e44f1 — Environment-variable access.
pkgs/python/[email protected]/pydantic/json_schema.py:344 
                if os.getenv('PYDANTIC_PRIVATE_ALLOW_UNHANDLED_SCHEMA_TYPES'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57743c12ff347f73 — Filesystem access.
pkgs/python/[email protected]/pydantic/mypy.py:1411 
    with open(config_file, 'rb') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdc96c50440c8c54 — Environment-variable access.
pkgs/python/[email protected]/pydantic/plugin/_loader.py:27 
    disabled_plugins = os.getenv('PYDANTIC_DISABLE_PLUGINS')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dacb0fedda1e91f0 — Environment-variable access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:173 
            env_vars: Mapping[str, Optional[str]] = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b16e547963706fbd — Environment-variable access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:175 
            env_vars = {k.lower(): v for k, v in os.environ.items()}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36876f193045b775 — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:307 
                    secret_value = path.read_text().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8efac466d5dbc85a — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/mypy.py:948 
    with open(config_file, read_mode) as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #982ebf96f00ab7f5 — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/parse.py:57 
    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pymochow

python dependency
expand_more 2 low-confidence finding(s)
low egress dependency Excluded from app score #87dd56cc85b6967a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pymochow/http/http_client.py:220 
                    http_response = self.session.post(url, data=body,
                            params=params,
                            headers=headers,
                            timeout=timeout_in_s)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #4739bc3fabda34da — Filesystem access.
pkgs/python/[email protected]/setup.py:19 
with io.open(os.path.join("pymochow", "__init__.py"), "rt", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pymongo

python dependency
expand_more 117 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #bd89d02d26ca933a — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:292 
    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3e6f5d4aa1c48b8e — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:321 
    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cfd8863f58159e11 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:354 
    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3a57152f4e581387 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:64 
    base_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #29b23bbc334029d5 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:99 
            os.environ["AZUREKMS_VMNAME_PREFIX"] = "PYTHON_DRIVER"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5616719aa83afc25 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102 
            os.environ[

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f1d14edf82ff2dcb — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102 
            os.environ[
                "AZUREKMS_IMAGE"
            ] = "Canonical:0001-com-ubuntu-server-jammy:22_04-lts-gen2:latest"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c637d15291a78783 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:106 
            os.environ["GCPKMS_IMAGEFAMILY"] = "debian-12"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6fa1119a86bc1ec3 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:128 
        key_name = os.environ["KEY_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1afbd5566f9b74a9 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:129 
        key_vault_endpoint = os.environ["KEY_VAULT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #64c5dc63b0cfe5f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:17 
            urllib.request.urlopen(url)  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #2acaddf672341aa5 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:26 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ae9f361dea07ed1a — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:64 
        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d27e748643b7b50c — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:72 
    uri1 = os.environ["TEST_URI1"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #68e6087c6687a4fd — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:73 
    uri2 = os.environ["TEST_URI2"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b69200808294a6f9 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:81 
        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #15e04b3c0c07a52a — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:86 
    apache = os.environ["APACHE_BINARY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c79d6fd8c572869f — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:87 
    apache_config = os.environ["APACHE_CONFIG"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #65af26e8665b741a — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:34 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2bdddb2b595b34ef — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:36 
    if sub_test_name == "eks" and "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #34ccdba84738fc82 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:39 
            if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #41ff78c4f166696f — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:40 
                write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #34374fcd35d27200 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:62 
        return os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #37add0f56312911d — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:84 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #79afde9729c6379c — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:63 
    spec_dir = pathlib.Path(os.environ["MDB_SPECS"]) / "source"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #67c6d05f0dcc4241 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:126 
            with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d374723b09414b33 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:10 
    os.environ[name] = str(value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c554cb5e754bb92f — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:22 
    if "VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1aa39cd69c4da839 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:23 
        os.environ["MONGODB_VERSION"] = os.environ["VERSION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cad136c96821d0dd — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:32 
        os.environ["TOPOLOGY"] = "replica_set"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #678d2ed5e1340a34 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:33 
        os.environ["MONGODB_VERSION"] = "7.0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2a36ae13beea4d8e — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:35 
    if not os.environ.get("TEST_CRYPT_SHARED"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #af281e749d3c66a4 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:24 
AUTH = os.environ.get("AUTH", "noauth")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d93d2eb016a59ac3 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:25 
SSL = os.environ.get("SSL", "nossl")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #97aaa7993489814c — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:26 
UV_ARGS = os.environ.get("UV_ARGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3b642d0423980932 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:27 
TEST_PERF = os.environ.get("TEST_PERF")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d71ae8b8a2c08d04 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:28 
GREEN_FRAMEWORK = os.environ.get("GREEN_FRAMEWORK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #66d546dcc5ba0036 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:29 
TEST_ARGS = os.environ.get("TEST_ARGS", "").split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #84cabe1470470c59 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:30 
TEST_NAME = os.environ.get("TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b3fa8f4ada254391 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:31 
SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6ec730280d640065 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:53 
    with open("results.json") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #80e1d0eb4a370408 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:68 
    with open("report.json", "w", newline="\n") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1be99f3bb8fd349a — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:106 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #939f4f1323c6ba5f — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:150 
    if not os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #93cae2f75eed348d — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:153 
    if os.environ.get("PYMONGOCRYPT_LIB"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #573514668f9a95ae — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:204 
    if os.environ.get("DEBUG_LOG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #11ec251d0e9abeff — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:207 
    if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #db8ba55d3c49bfb2 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:57 
    value = os.environ.get(var, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5f6ec4e25c0655e8 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:65 
    with open("/etc/os-release") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6d4d8df12df98694 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:111 
        url = os.environ["LIBMONGOCRYPT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #f25761d836cb2bbd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:116 
    with request.urlopen(request.Request(url), timeout=15.0) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #ac591721afe9a28e — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:181 
            write_env(var, os.environ.get(var, getattr(opts, var.lower(), "")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #993b6c47c2e5cac2 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:200 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a4c3f3bef33e6777 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:223 
        if "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f9578b73b6b7c654 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:225 
                if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3809de81f95b684d — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:226 
                    write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0b805b645117b03a — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:268 
            os.environ["KRB5_CONFIG"] = str(krb_conf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #83bf51ba53881958 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281 
        SINGLE_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3ab7e7e128db90e0 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281 
        SINGLE_MONGOS_LB_URI = os.environ.get(
            "SINGLE_MONGOS_LB_URI", "mongodb://127.0.0.1:8000/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ee8e9612c2028724 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284 
        MULTI_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a07b279ec94c8a73 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284 
        MULTI_MONGOS_LB_URI = os.environ.get(
            "MULTI_MONGOS_LB_URI", "mongodb://127.0.0.1:8001/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e81147050f645ef2 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:304 
            os.environ["OCSP_SERVER_TYPE"] = sub_test_name

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2c223b6ec50809b6 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:306 
            if name not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b91fee42121d0f8c — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:309 
        server_type = os.environ["OCSP_SERVER_TYPE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ff647f97bc3c19bf — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:310 
        orch_file = os.environ["ORCHESTRATION_FILE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9de3eb4db19fd1e2 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:321 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4c49ec4979a6c194 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:328 
        version = os.environ.get("VERSION", "latest")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bf3b0747cb230d97 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:349 
    compressors = os.environ.get("COMPRESSORS") or opts.compressor

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #72b63e5dbac4bf20 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:412 
        if "AWS_ROLE_SESSION_NAME" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #639ac282f02e0792 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:472 
        framework = opts.green_framework or os.environ["GREEN_FRAMEWORK"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ddc5d5eeb11ff3df — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:10 
TEST_NAME = os.environ.get("TEST_NAME", "unconfigured")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cfa8108a907bf6fc — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:11 
SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6d0387e68bc64c0c — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:52 
    Path(os.environ["OUTPUT_FILE"]).unlink(missing_ok=True)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e07f4a05977f1a02 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:61 
if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #073959f03c2a54fe — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:15 
DRIVERS_TOOLS = os.environ.get("DRIVERS_TOOLS", "").replace(os.sep, "/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d3146f39bda26a41 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:169 
        if env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #27a4df26567066e8 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:173 
                opts.auth = os.environ.get("AUTH") == "auth"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6ff2ce4086821534 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:175 
                ssl_opt = os.environ.get("SSL", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #07bcb2ed09c6e2ab — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:178 
                if os.environ[env_var]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e0c0e36ea9bf6511 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:181 
                setattr(opts, key, os.environ[env_var])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d1c4ab4bf47f1b83 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:211 
    env = kwargs.pop("env", os.environ).copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57a9c442550a8422 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:71 
            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b75d2c3b8b2c979 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:88 
            if "ProgramFiles" in os.environ and "ProgramFiles(x86)" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e85426314c9e99c4 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:89 
                os.environ["ProgramFiles(x86)"] = os.environ["ProgramFiles"] + " (x86)"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4067e7fd5d48f379 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:94 
            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d43fbea7ceaf676c — Environment-variable access.
pkgs/python/[email protected]/_setup.py:127 
if "--no_ext" in sys.argv or os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #f511419555ec9617 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pymongo/_azure_helpers.py:36 
        with urlopen(request, timeout=timeout) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c6f2e008c129da30 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pymongo/_gcp_helpers.py:29 
        with urlopen(request, timeout=timeout) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #3f202c5104c77cb3 — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:81 
        token_file = os.environ.get("OIDC_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46fa449bbc25131b — Filesystem access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:86 
        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73c8c4d657a97eff — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:92 
        token_file = os.environ.get("AWS_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80dfe30db9e3f3ef — Filesystem access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:97 
        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8053ca7a07f6786 — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:129 
        if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #916bb0cfa462f039 — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:130 
            fname = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80018f973ea32646 — Filesystem access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:131 
    with open(fname) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ddcfed7347bca81 — Filesystem access.
pkgs/python/[email protected]/pymongo/common.py:238 
    open(value).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5be5dfd5f5aefa8f — Filesystem access.
pkgs/python/[email protected]/pymongo/daemon.py:64 
            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3cbe59226974933 — Filesystem access.
pkgs/python/[email protected]/pymongo/daemon.py:95 
            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c797856576c75104 — Environment-variable access.
pkgs/python/[email protected]/pymongo/logger.py:165 
        document_length = int(os.getenv("MONGOB_LOG_MAX_DOCUMENT_LENGTH", _DEFAULT_DOCUMENT_LENGTH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #f570682e86be5e8d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/pymongo/ocsp_support.py:295 
            response = _post(
                uri,
                data=ocsp_request.public_bytes(_Encoding.DER),
                headers={"Content-Type": "application/ocsp-request"},
                timeout=timeout,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #fb6e22257a5566f7 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:78 
        "architecture": os.environ.get("PROCESSOR_ARCHITECTURE") or platform.machine(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33b8b27cb5d33f4d — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:119 
    if os.getenv(ENV_VAR_K8S):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d09345b0520fc138 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:126 
    if os.getenv("AWS_LAMBDA_RUNTIME_API"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b81c0868477626e — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:128 
    env = os.getenv("AWS_EXECUTION_ENV")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7056985f01843824 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:135 
    return bool(os.getenv("FUNCTIONS_WORKER_RUNTIME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #821793903b5c8446 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:139 
    return bool(os.getenv("K_SERVICE") or os.getenv("FUNCTION_NAME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2dcc9da7a46d0b1d — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:143 
    return bool(os.getenv("VERCEL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5f133c0aad7477a — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:152 
    val = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7af2f62275021a6 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:171 
        region = os.getenv("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #129015ac6708ab5f — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:181 
        region = os.getenv("FUNCTION_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6036bfcf772b4427 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:192 
        region = os.getenv("VERCEL_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #81de3cd837e3d836 — Filesystem access.
pkgs/python/[email protected]/tools/compare_import_time.py:23 
    with open(f"pymongo-{sha}.log") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2d745614e49d3662 — Filesystem access.
pkgs/python/[email protected]/tools/convert_test_to_async.py:123 
    with open(input_file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6629dee5e4588edf — Filesystem access.
pkgs/python/[email protected]/tools/convert_test_to_async.py:127 
        with open(output_file, "w+") as f2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2366348ea885953f — Filesystem access.
pkgs/python/[email protected]/tools/ensure_future_annotations_import.py:29 
        with open(path) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f33c7a087c955ddc — Filesystem access.
pkgs/python/[email protected]/tools/synchro.py:290 
            with open(file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5e527e5970093bb5 — Environment-variable access.
pkgs/python/[email protected]/tools/synchro.py:442 
            and "OVERRIDE_SYNCHRO_CHECK" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pymysql

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #448b33800565481d — Filesystem access.
pkgs/python/[email protected]/pymysql/connections.py:1460 
            with open(self.filename, "rb") as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytz

python dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #b0bc7e4ce5c1b889 — Environment-variable access.
pkgs/python/[email protected]/pytz/__init__.py:91 
    zoneinfo_dir = os.environ.get('PYTZ_TZDATADIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85a3af08924b24e3 — Filesystem access.
pkgs/python/[email protected]/pytz/__init__.py:118 
    return open(filename, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1ba0313380534bc — Environment-variable access.
pkgs/python/[email protected]/pytz/__init__.py:124 
        if os.environ.get('PYTZ_SKIPEXISTSCHECK', ''):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e2562dcaa2876f3 — Filesystem access.
pkgs/python/[email protected]/pytz/tzfile.py:130 
                      open(os.path.join(base, 'Australia', 'Melbourne'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab8e1bcd9bff0be8 — Filesystem access.
pkgs/python/[email protected]/pytz/tzfile.py:132 
                      open(os.path.join(base, 'US', 'Eastern'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b3dbfd3e763b938 — Filesystem access.
pkgs/python/[email protected]/setup.py:31 
    long_description=open('README.rst', 'r').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

qdrant-client

python dependency
expand_more 13 low-confidence finding(s)
low egress dependency Excluded from app score #ca218a0d491d58b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/qdrant_client/common/version_check.py:15 
    response = httpx.get(rest_uri, headers=rest_headers, auth=auth_provider, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #73136c03da6f80e1 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/embed/schema_parser.py:298 
        with open(output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #deaec6fb7a8276ce — Filesystem access.
pkgs/python/[email protected]/qdrant_client/embed/utils.py:76 
    with open(path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bc8bddf76cc94fa — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:99 
            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #434ed93a3eaae1ba — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:102 
            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53a807448244cd8b — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:125 
            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02d774014cd27061 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:127 
        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fc4993f06cc5072 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:146 
        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbb6cc33ff61c252 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:102 
            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b38ffcf3b5f405f — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:105 
            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55efb730c4e8ce3b — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:136 
            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d148430453f69f3f — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:138 
        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e8992091fcd5c13 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:162 
        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sqlalchemy

python dependency
expand_more 29 low-confidence finding(s)
low egress dependency Excluded from app score #6e9a03fcf9a51c19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/lib/sqlalchemy/pool/impl.py:145 
            self._pool.put(record, False)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling reachable #e5e308256b513594 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:42 
            with open(
                Path(cachedir) / "sqla_mypy_config.cfg", "w"
            ) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #c0c5349a6a53936e — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:56 
            with open(
                Path(cachedir) / "plain_mypy_config.cfg", "w"
            ) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #b229bf1f5a587e8a — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:106 
            os.environ.pop("MYPY_FORCE_COLOR", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #b102d6cc52c65749 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/fixtures/mypy.py:146 
        with open(path) as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ca75782031a7588 — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/plugin_base.py:398 
    if os.environ.get("REQUIRE_SQLALCHEMY_CEXT", "0") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18b21e1ecbe60f20 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/plugin_base.py:455 
            with open(options.write_idents, "a") as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d2a7be5cdc6de36 — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/plugin/pytestplugin.py:880 
        return os.environ.get("PYTEST_CURRENT_TEST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53590e0279ca5672 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/profiling.py:200 
            profile_f = open(self.fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #356a2aa6ee6c112e — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/profiling.py:219 
        profile_f = open(self.fname, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1688b5e0a50acd9b — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/testing/provision.py:453 
    with open(idents_file) as file_:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b54860f5972f212c — Environment-variable access.
pkgs/python/[email protected]/lib/sqlalchemy/util/_has_cy.py:27 
    if os.environ.get("DISABLE_SQLALCHEMY_CEXT_RUNTIME"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5d2ecaeec051b84 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:134 
            Path(destination_path).write_text(
                text, encoding="utf-8", newline="\n"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25c86ac466b5eb8b — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:146 
            with open(tempfile) as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5607a9716823314d — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:162 
            with open(source_file, encoding="utf-8") as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74e1b15077e12b36 — Filesystem access.
pkgs/python/[email protected]/lib/sqlalchemy/util/tool_support.py:169 
        with open(destination_path, encoding="utf-8") as dp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aea4de9895dcf098 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:95 
    cmd.extend(os.environ.get(dburl_env, default_dburl).split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d71b37a056e23b98 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:106 
    env_dbdrivers = os.environ.get(extra_driver_env, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6990c07477bc4d3f — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:269 
    cmd.extend(os.environ.get("TOX_WORKERS", "-n4").split())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e30d4af89b254789 — Environment-variable access.
pkgs/python/[email protected]/setup.py:23 
DISABLE_EXTENSION = bool(os.environ.get("DISABLE_SQLALCHEMY_CEXT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92be160ce1f314d8 — Environment-variable access.
pkgs/python/[email protected]/setup.py:24 
REQUIRE_EXTENSION = bool(os.environ.get("REQUIRE_SQLALCHEMY_CEXT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9a70969be5165569 — Filesystem access.
pkgs/python/[email protected]/tools/format_docs_code.py:155 
    original = file.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8b0998a43291129f — Filesystem access.
pkgs/python/[email protected]/tools/format_docs_code.py:313 
                file.write_text(updated, "utf-8", newline="\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4ec2d6665b8fb348 — Filesystem access.
pkgs/python/[email protected]/tools/generate_proxy_methods.py:145 
    with open(fn.__code__.co_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5dadbaf56636b8c7 — Filesystem access.
pkgs/python/[email protected]/tools/generate_proxy_methods.py:373 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #846e4b085a484983 — Filesystem access.
pkgs/python/[email protected]/tools/generate_sql_functions.py:38 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #150766e36195d29e — Filesystem access.
pkgs/python/[email protected]/tools/generate_tuple_map_overloads.py:53 
        open(filename) as orig_py,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ffff6ceba8dd3162 — Filesystem access.
pkgs/python/[email protected]/tools/normalize_file_headers.py:27 
    content = file.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5f8011ba123a7034 — Filesystem access.
pkgs/python/[email protected]/tools/sync_test_files.py:35 
    source_data = Path(source).read_text().replace(remove_str, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

upstash-vector

python dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #adebc20dd178996c — Environment-variable access.
pkgs/python/[email protected]/upstash_vector/client.py:74 
            environ["UPSTASH_VECTOR_REST_URL"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b5b12475ca54aec — Environment-variable access.
pkgs/python/[email protected]/upstash_vector/client.py:75 
            environ["UPSTASH_VECTOR_REST_TOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d417afa5ee0db7f — Environment-variable access.
pkgs/python/[email protected]/upstash_vector/client.py:142 
            environ["UPSTASH_VECTOR_REST_URL"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4de65fc65c86fe95 — Environment-variable access.
pkgs/python/[email protected]/upstash_vector/client.py:143 
            environ["UPSTASH_VECTOR_REST_TOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad069221b4b8177d — Environment-variable access.
pkgs/python/[email protected]/upstash_vector/http.py:22 
        if os.getenv("VERCEL"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5239a4ed8bb2f923 — Environment-variable access.
pkgs/python/[email protected]/upstash_vector/http.py:24 
        elif os.getenv("AWS_REGION"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

valkey

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #11f84314ad7e5b6c — Filesystem access.
pkgs/python/[email protected]/setup.py:7 
    long_description=open("README.md").read().strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5156137d310e8de1 — Filesystem access.
pkgs/python/[email protected]/valkey/commands/json/commands.py:317 
        with open(file_name) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #18ac906a553629ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/valkey/ocsp.py:271 
        r = requests.get(issuer_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2fa43b8edd8d8665 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/valkey/ocsp.py:284 
        r = requests.get(ocsp_url, headers=header)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

vecs

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #9b438395ce34e66e — Filesystem access.
pkgs/python/[email protected]/setup.py:29 
    with open(module_path) as module:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fce5b32edb8269d — Filesystem access.
pkgs/python/[email protected]/setup.py:40 
long_description = (Path(__file__).parent / "README.md").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

weaviate-client

python dependency
expand_more 41 low-confidence finding(s)
low env_fs dependency Excluded from app score #7cecd38699b949db — Environment-variable access.
pkgs/python/[email protected]/integration/conftest.py:358 
        api_key = os.environ.get("OPENAI_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92450970e80b2564 — Environment-variable access.
pkgs/python/[email protected]/integration/conftest.py:405 
        api_key = os.environ.get("OPENAI_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c0867e84b462ba0d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/integration/test_auth.py:26 
    response = httpx.get("http://" + url + "/v1/.well-known/openid-configuration")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #d8f70e0a0794fc18 — Environment-variable access.
pkgs/python/[email protected]/integration/test_auth.py:47 
    client_secret = os.environ.get(env_variable_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #211ea683db53eb3b — Environment-variable access.
pkgs/python/[email protected]/integration/test_auth.py:101 
    pw = os.environ.get(env_variable_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #b3a144a33a83b05c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/integration/test_auth.py:143 
    weaviate_open_id_config = httpx.get("http://" + url + "/v1/.well-known/openid-configuration")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d0fb93621cd0d103 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/integration/test_auth.py:149 
    response_auth = httpx.get(href)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #c430024c424136c9 — Environment-variable access.
pkgs/python/[email protected]/integration/test_auth.py:188 
    pw = os.environ.get(env_variable_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cef422e6753a252 — Environment-variable access.
pkgs/python/[email protected]/integration/test_auth.py:207 
    pw = os.environ.get("OKTA_DUMMY_CI_PW")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a6f56286dd2eec0 — Environment-variable access.
pkgs/python/[email protected]/integration/test_client.py:700 
    with mock.patch.dict(os.environ, {"PYPI_PACKAGE_URL": "http://does-not-exist"}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa6b7cad700b0791 — Environment-variable access.
pkgs/python/[email protected]/integration/test_client.py:707 
    with mock.patch.dict(os.environ, {"PYPI_PACKAGE_URL": "http://does-not-exist"}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2aef4bd8bdd66cf1 — Environment-variable access.
pkgs/python/[email protected]/integration/test_collection_openai.py:584 
    api_key = os.environ.get("COHERE_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7c20f60c0516eba — Environment-variable access.
pkgs/python/[email protected]/integration/test_collection_openai.py:750 
    api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85b3fd404b613960 — Environment-variable access.
pkgs/python/[email protected]/integration/test_collection_openai.py:794 
    api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4cbabcfda95e2bc — Environment-variable access.
pkgs/python/[email protected]/integration/test_collection_openai.py:837 
    contextual_api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69fd5a1e593c21c2 — Environment-variable access.
pkgs/python/[email protected]/integration/test_collection_rerank.py:31 
    api_key = os.environ.get("COHERE_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8097a1648ebb9cf — Environment-variable access.
pkgs/python/[email protected]/integration/test_collection_rerank.py:85 
    api_key = os.environ.get("COHERE_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f20f711f644bc98 — Environment-variable access.
pkgs/python/[email protected]/integration/test_collection_rerank.py:145 
    api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9308ee733e117ed0 — Environment-variable access.
pkgs/python/[email protected]/integration/test_vectors.py:866 
    api_key = os.environ.get("JINAAI_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b6e1ef7bc935830 — Filesystem access.
pkgs/python/[email protected]/profiling/test_shutdown.py:48 
    with open("uuids.json", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17378fd5f44cbe68 — Filesystem access.
pkgs/python/[email protected]/profiling/test_sphere.py:33 
        with open(sphere_file) as jsonl_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efcf619a7ae8137e — Filesystem access.
pkgs/python/[email protected]/profiling/test_sphere.py:82 
        with open(sphere_file) as jsonl_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4ab8172fbb792c7e — Filesystem access.
pkgs/python/[email protected]/tools/stubs.py:177 
            with open(file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a9d4dde9b73963f — Environment-variable access.
pkgs/python/[email protected]/weaviate/__init__.py:50 
os.environ["GRPC_VERBOSITY"] = "ERROR"  # https://github.com/danielmiessler/fabric/discussions/754

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3b80e54f6eba5ba — Environment-variable access.
pkgs/python/[email protected]/weaviate/collections/batch/base.py:61 
    os.getenv("WEAVIATE_BATCH_MAX_RETRIES", "9.299")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9eee6f0ff08a91af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/weaviate/connect/authentication.py:129 
                    return resp(await client.get(self._open_id_config_url))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #52104fcca5015f6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/weaviate/connect/authentication.py:137 
            return resp(client.get(self._open_id_config_url))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #b07cf6d9c26659cf — Environment-variable access.
pkgs/python/[email protected]/weaviate/connect/base.py:202 
    http_proxy = (os.environ.get("HTTP_PROXY"), os.environ.get("http_proxy"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59243ff60a4b1f0a — Environment-variable access.
pkgs/python/[email protected]/weaviate/connect/base.py:203 
    https_proxy = (os.environ.get("HTTPS_PROXY"), os.environ.get("https_proxy"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9d1f76df1951cc2 — Environment-variable access.
pkgs/python/[email protected]/weaviate/connect/base.py:204 
    grpc_proxy = (os.environ.get("GRPC_PROXY"), os.environ.get("grpc_proxy"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #a8442c704904de7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/weaviate/connect/v4.py:408 
                        response = await client.get(oidc_url, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e3d6adbc5907fb50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/weaviate/connect/v4.py:423 
                response = client.get(oidc_url, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3f50f3e01330e78 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/weaviate/connect/v4.py:753 
                        res = await client.get(PYPI_PACKAGE_URL, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #76152da83c2917ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/weaviate/connect/v4.py:762 
                res = client.get(PYPI_PACKAGE_URL, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #be3242f53f8a32c3 — Environment-variable access.
pkgs/python/[email protected]/weaviate/embedded.py:38 
    persistence_data_path: str = os.environ.get("XDG_DATA_HOME", DEFAULT_PERSISTENCE_DATA_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3b342985ba62c02 — Environment-variable access.
pkgs/python/[email protected]/weaviate/embedded.py:39 
    binary_path: str = os.environ.get("XDG_CACHE_HOME", DEFAULT_BINARY_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #827ebe15c9c4df87 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/weaviate/embedded.py:91 
            response = httpx.get("https://api.github.com/repos/weaviate/weaviate/releases/latest")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #70cf8b097b690aec — Environment-variable access.
pkgs/python/[email protected]/weaviate/embedded.py:205 
        my_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdeae496d4143b97 — Environment-variable access.
pkgs/python/[email protected]/weaviate/logger.py:5 
logger.setLevel(os.getenv("WEAVIATE_LOG_LEVEL", "INFO"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4013eee71729583b — Filesystem access.
pkgs/python/[email protected]/weaviate/util.py:83 
        with open(image_or_image_path, "br") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7cbea563925b3b5 — Filesystem access.
pkgs/python/[email protected]/weaviate/util.py:126 
            file = open(file_or_file_path, "br")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • next prod — tarball exceeds byte cap
  • @types/redis prod — no javascript source
  • input-otp prod — dist-only: no readable source
  • react-resizable-panels prod — dist-only: no readable source
  • partial-json prod — dist-only: no readable source
  • @opencode-ai/plugin prod — dist-only: no readable source
  • spacy prod — no sdist (wheels only)
  • faiss-cpu prod — no sdist (wheels only)
  • redis prod — scan budget exceeded
  • redisvl prod — scan budget exceeded
  • elasticsearch prod — scan budget exceeded
  • pymilvus prod — scan budget exceeded
  • langchain-aws prod — scan budget exceeded
  • groq prod — scan budget exceeded
  • together prod — scan budget exceeded
  • litellm prod — scan budget exceeded
  • ollama prod — scan budget exceeded
  • vertexai prod — scan budget exceeded
  • google-generativeai prod — scan budget exceeded
  • google-genai prod — scan budget exceeded
  • langchain prod — scan budget exceeded
  • langchain-community prod — scan budget exceeded
  • langchain-core prod — scan budget exceeded
  • sentence-transformers prod — scan budget exceeded
  • transformers prod — scan budget exceeded
  • opensearch-py prod — scan budget exceeded
  • fastembed prod — scan budget exceeded
  • typer prod — scan budget exceeded
  • rich prod — scan budget exceeded
  • mem0ai prod — scan budget exceeded