Close Open Privacy Scan

link https://github.com/evanw/esbuild
bolt Snapshot: commit 6ff1d8b
science engine v1
schedule 2026-06-24T07:22:16.359586+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

App Privacy Score

97 /100
Low privacy risk

Low risk · 78 finding(s)

Dependency score: 82 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 1 medium 77 low
First-party packages: 1
Dependency packages: 1
Ecosystem: go

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)
medium golang.org/x/sys dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/unix/linux/mksysnum.go:91 → pkgs/go/[email protected]/unix/linux/mksysnum.go:138

</> First-Party Code

first-party (go)

go first-party
expand_more 19 low-confidence finding(s)
low env_fs production #6d708186d5d35a5e — Environment-variable access.
repo/cmd/esbuild/main.go:19 
	if _, ok := os.LookupEnv("NO_COLOR"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b109fa20c0722824 — Filesystem access.
repo/cmd/esbuild/main_other.go:16 
	f, err := os.Create(traceFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b8dde4fc2f84b3ee — Filesystem access.
repo/cmd/esbuild/main_other.go:30 
	f, err := os.Create(heapFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe9d306b7a162a82 — Filesystem access.
repo/cmd/esbuild/main_other.go:46 
	f, err := os.Create(cpuprofileFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #678a99597bc28855 — Filesystem access.
repo/cmd/esbuild/service.go:1168 
		bytes, err := ioutil.ReadFile(input)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #218c2e135aa66def — Filesystem access.
repo/cmd/esbuild/service.go:1186 
		if err := ioutil.WriteFile(file, result.Code, 0644); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c3b36eada4a7bb6b — Filesystem access.
repo/cmd/esbuild/service.go:1196 
		if err := ioutil.WriteFile(file, result.Map, 0644); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #411f54d951518ed2 — Filesystem access.
repo/internal/fs/fs_real.go:202 
	buffer, originalError := ioutil.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #919caa3b4e34ac99 — Filesystem access.
repo/internal/fs/fs_real.go:265 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f6834206b3d7409b — Filesystem access.
repo/internal/fs/fs_real.go:353 
	f, originalError := os.Open(dirname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #60e9b58d5754e0f6 — Filesystem access.
repo/internal/fs/fs_real.go:532 
				if buffer, err := ioutil.ReadFile(path); err != nil || string(buffer) != data.fileContents {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #43752641d9f3ab79 — Environment-variable access.
repo/internal/logger/logger.go:138 
			if _, ok := os.LookupEnv("WT_SESSION"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45bf7f9f2d2a9a0a — Environment-variable access.
repo/internal/logger/logger.go:343 
		if _, ok := os.LookupEnv("NO_COLOR"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f807a5be1b496e8 — Environment-variable access.
repo/pkg/api/api_impl.go:1223 
	if userAgent, ok := os.LookupEnv("npm_config_user_agent"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c0c2a31571c250ad — Filesystem access.
repo/pkg/api/api_impl.go:1575 
						if contents, err := ioutil.ReadFile(result.AbsPath); err == nil && bytes.Equal(contents, result.Contents) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #90cca3d182d95f83 — Filesystem access.
repo/pkg/api/api_impl.go:1588 
						if err := ioutil.WriteFile(result.AbsPath, result.Contents, mode); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb6afb4a9bcc9d15 — Environment-variable access.
repo/pkg/cli/cli_impl.go:1214 
		if value, ok := os.LookupEnv("NODE_PATH"); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f9de213c426907e1 — Filesystem access.
repo/pkg/cli/cli_impl.go:1287 
					if err := ioutil.WriteFile(metafileAbsPath, []byte(json), 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c0a344261a450288 — Filesystem access.
repo/pkg/cli/cli_impl.go:1334 
					if err := ioutil.WriteFile(mangleCacheAbsPath, bytes, 0666); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

golang.org/x/sys

go dependency
medium pii_flow dependency Excluded from app score #03b4c166f98ec4ef — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/unix/linux/mksysnum.go:138 · flow /tmp/closeopen-xpx_e3hy/pkgs/go/[email protected]/unix/linux/mksysnum.go:91 → /tmp/closeopen-xpx_e3hy/pkgs/go/[email protected]/unix/linux/mksysnum.go:138 
	fmt.Printf(template, cmdLine(), goBuildTags(), plusBuildTags(), text)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 58 low-confidence finding(s)
low env_fs dependency Excluded from app score #b5fd57eae3cc7eea — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu.go:220 
	env := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b05131989583a92 — Filesystem access.
pkgs/go/[email protected]/cpu/hwcap_linux.go:27 
	buf, err := ioutil.ReadFile(procAuxv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4061bf7009b2de41 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:96 
	goos := os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #139b9b41d3090f8f — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:97 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a581bca65bd94d4d — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:99 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3a8753024272169 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:104 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d581092f7d8876e6 — Filesystem access.
pkgs/go/[email protected]/plan9/mksyscall.go:133 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc3630810fbcc4bc — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:436 
		src, err := ioutil.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d34e047498e301c5 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:460 
	f, err := os.Create(mergedFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c85da96edb10ba9a — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:488 
		err = ioutil.WriteFile(inFile.name, src, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89c0c0d96d5e3964 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:182 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e703b2ef41bf6c10 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:240 
	cmd.Env = append(os.Environ(), "GOARCH_TARGET="+t.GoArch)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f04cc871758c54df — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:273 
	if fmtCmd.Stdout, err = os.Create(outputFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f37c4c1acf3172c — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:383 
	if file, err := os.Create(stubsFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0dffae07e32d566c — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:404 
	cc := os.Getenv("CC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e341424e8ee82d4d — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:419 
	abiFile, err := os.Create(filepath.Join(abiDir, "abi.h"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37bdd41c2bb68a6e — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:567 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a95d874e7f9d7daa — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:691 
	f, err := os.Create(fmt.Sprintf("zptrace_%s_linux.go", archName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ad4d51eea49b409 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:721 
	f, err := os.Create(fmt.Sprintf("zptrace_linux_%s.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cce3584caefe7c14 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:756 
	data, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15311e1bb676397c — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:74 
	goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #520fc3675e7fb29d — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:75 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #811a14da65059ea0 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:77 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8e3338b06bed84e — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:85 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #047a874474a8d5da — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:91 
	cc := os.Getenv("CC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85c485b7fcf47b1f — Filesystem access.
pkgs/go/[email protected]/unix/mkasm_darwin.go:51 
	err := ioutil.WriteFile(fileName, out.Bytes(), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cec42c45b856f56 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm_darwin.go:93 
	err := ioutil.WriteFile(fileName, out.Bytes(), 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fba189818a7cd22 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm_darwin.go:100 
	in1, err := ioutil.ReadFile("syscall_darwin.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #964f29a8949cd010 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm_darwin.go:105 
	in2, err := ioutil.ReadFile(fmt.Sprintf("syscall_darwin_%s.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52ebc0ec16039774 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm_darwin.go:109 
	in3, err := ioutil.ReadFile(fmt.Sprintf("zsyscall_darwin_%s.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e751cb60f4657388 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm_darwin.go:117 
	in1, err = ioutil.ReadFile("syscall_darwin.1_13.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #035fc7dd11adf90a — Filesystem access.
pkgs/go/[email protected]/unix/mkasm_darwin.go:121 
	in2, err = ioutil.ReadFile(fmt.Sprintf("zsyscall_darwin_%s.1_13.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #014eed27dea4e67a — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:27 
	goos := os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61d0d0f5eaaa2fca — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:28 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f18f20020d605a9 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:30 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be4890b8a1135a21 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:34 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a61623639e52e1ba — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:95 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9acfcc0df8ac2ffc — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:97 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #daf4dbb93d108769 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:106 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbd18eb11166245b — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall.go:135 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ecc38093dc146c8 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc.go:106 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7abc9ef3c89605bd — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:155 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6caeee7910318430 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:528 
	err := ioutil.WriteFile("zsyscall_aix_ppc64.go",
		[]byte(fmt.Sprintf(srcTemplate1, cmdLine(), goBuildTags(), plusBuildTags(), pack, imp, textcommon)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #faac585bf17bdba7 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:539 
	err = ioutil.WriteFile("zsyscall_aix_ppc64_gc.go",
		[]byte(fmt.Sprintf(srcTemplate2, cmdLine(), goBuildTags(), plusBuildTags(), pack, imp, dynimports, linknames, vardecls, textgc)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b24891081fa23705 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:548 
	err = ioutil.WriteFile("zsyscall_aix_ppc64_gccgo.go",
		[]byte(fmt.Sprintf(srcTemplate3, cmdLine(), goBuildTags(), plusBuildTags(), pack, cExtern, imp, textgccgo)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3a51cce1571319c — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_solaris.go:109 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d21f099be410b67b — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:128 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6627b43562b33326 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:130 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ca788c0f7f53518 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:133 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf9cd347baee7934 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:135 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f74776c12dd50b6 — Filesystem access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:265 
		file, err := os.Open(filepath.Join("/usr/include", header))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #349779666b8c73db — Filesystem access.
pkgs/go/[email protected]/unix/mksysnum.go:77 
	file, err := os.Open(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a0a6609ef834a9e — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:97 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64043b0d8379bd31 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:99 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9825c2bdcade2fab — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:102 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58915da825743015 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:104 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60a592216799a292 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:718 
	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8353bf776f643c9 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:881 
		err = ioutil.WriteFile(*filename, data, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.