Close Open Privacy Scan
App Privacy Score
Low risk · 41 finding(s)
Dependency score: 100 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
%s::ffff:192.168.0.1a2a-protocol.orgaccounts.google.comadaptivecrawl-kir3wx7b3a-uc.a.run.appadaptivecrawlstatus-kir3wx7b3a-uc.a.run.appagentskills.ioahooks.js.orgai-gateway.vercel.shai-sdk.devai.google.devai.pydantic.devaiplatform.googleapis.comaka.msaliyun-log-cli.readthedocs.ioaliyun-log-python-sdk.readthedocs.ioanalytics.google.comaomediacodec.github.ioapi.cerebras.aiapi.deepseek.comapi.dify.aiapi.eu.sendgrid.comapi.firecrawl.devapi.fireworks.aiapi.github.comapi.groq.comapi.langfuse.comapi.moonshot.aiapi.notion.comapi.sambanova.aiapi.sendgrid.comapi.slack.comapi.smith.langchain.comapi.studio.nebius.comapi.together.xyzapi.voyageai.comapi.wandb.aiapi.x.aiapi.z.aiapi2.amplitude.comapm.tencentcloudapi.comapp.arize.comapp.firecrawl.devapp.phoenix.arize.comapp.tavily.comapp.watercrawl.devarms.console.aliyun.comarxiv.orgassets.dify.aiawesome.worker.comaws.amazon.comazure.microsoft.combase-ui.combit.lybitbucket.orgbjoern.hoehrmann.deblog.research.googleblogs.oracle.combosh.ioboto3.amazonaws.combrotlipy.readthedocs.iobugs.python.orgcassandra.apache.orgcdn-cookieyes.comcdn.jsdelivr.netcdnjs.cloudflare.comchevrotain.iochrome.google.comclickhouse.comcloud.dify.aicloud.google.comcloud.langfuse.comcloud.tencent.comcn-beijing.log.aliyuncs.comcode.activestate.comcode.google.comcognitiveservices.azure.comcohere.comcommonmark.orgconnect.buildconnectrpc.comconsole.cloud.google.comconsole.cloud.tencent.comconsole.developers.google.comconsole.dify.aiconsole.groq.comcookbook.openai.comcouchdb.apache.orgcreators.dify.aicustom.s3dashscope-intl.aliyuncs.comdatastax.github.iodatatracker.ietf.orgday.js.orgdb.apache.orgdeveloper.android.comdeveloper.apple.comdeveloper.mozilla.orgdevelopers.google.comdevelopers.googleblog.comdevelopers.openai.comdevguide.python.orgdify.aidify.localdiscord.ggdiscuss.python.orgdocs.ag-ui.comdocs.ag2.aidocs.anthropic.comdocs.arize.comdocs.aws.amazon.comdocs.celeryproject.orgdocs.celeryq.devdocs.claude.comdocs.cloud.google.comdocs.cohere.comdocs.databricks.comdocs.datastax.comdocs.dify.aidocs.docker.comdocs.exa.aidocs.firecrawl.devdocs.github.comdocs.langfuse.comdocs.litellm.aidocs.llamaindex.aidocs.microsoft.comdocs.mistral.aidocs.mongodb.comdocs.nvidia.comdocs.openssl.orgdocs.oracle.comdocs.pydantic.devdocs.python-requests.orgdocs.python.orgdocs.ray.iodocs.redhat.comdocs.rsdocs.smith.langchain.comdocs.tavily.comdocs.voyageai.comdocs.watercrawl.devdocs.x.aidocs.z.aidocumentation.softwareag.comdrive.google.comdspy.aidubbo.apache.orgemail.twilio.comen.wikipedia.orgenterprise-docs.dify.aierrors.pydantic.devexam_ple.comexample.es.region.aws.found.ioexamples.comfastapi.tiangolo.comfirebase.google.comflask-login.readthedocs.ioflask.palletsprojects.comfonts.googleapis.comfoo.comforum.dify.aigateway-eu.pydantic.devgateway-us.pydantic.devgateway.pydantic.devgateway.pydantic.infogcp.gce.instance.hostnamegenerativelanguage.googleapis.comgeode.apache.orggist.github.comgit-scm.comgitea.iogithub.comgitlab.comgofastmcp.comgoo.glgoogle-auth.readthedocs.iogoogle.aip.devgoogle.github.iogoogleapis.github.iogroq.comgrpc.ioh2database.comhaproxy.1wt.euhbase.apache.orghelp.aliyun.comhf.cohive.apache.orghsqldb.orghtml.spec.whatwg.orghtml5lib.readthedocs.iohttpbin.orghttpd.apache.orghuggingface.cohypothesis.readthedocs.ioi.pravatar.ccimages.unsplash.comimg.shields.ioimg.website.cominference-docs.cerebras.aiinstance-name.cn-hangzhou.ots.aliyuncs.cominteractive-examples.mdn.mozilla.netjina.aijson-schema.orgkombu.readthedocs.orgkubernetes.iolangfuse.comlearn.microsoft.comlocalhost.tiangolo.comlogfire-eu.pydantic.devlogfire-eu.pydantic.infologfire-us.pydantic.devlogfire-us.pydantic.infologfire.pydantic.devlogin.microsoft.comman7.orgmanagement.core.chinacloudapi.cnmanagement.core.usgovcloudapi.netmanagement.core.windows.netmariadb.orgmarketplace.dify.aimaxdb.sap.commemcached.orgmistral.aimlflow.orgmodelcontextprotocol.iomodels.github.aimy-provider.commy-sharepoint-site.commy.domain.commypy.readthedocs.iomystorageaccount.blob.core.windows.netmüller.denats.ioneo4j.comnull.python.orgnumpydoc.readthedocs.ionvlpubs.nist.govoai.endpoints.kepler.ai.cloud.ovh.netoauth2.googleapis.comobjectstorage.us-phoenix-1.oraclecloud.comobs.cn-north-4.myhuaweicloud.comocsp.verisign.comopenai.comopencode.aiopencollective.comopenfeature.devopenrouter.aiopensearch.orgopentelemetry-python-contrib.readthedocs.ioopentelemetry-python.readthedocs.ioopentelemetry.ioosi-model.comoss.redis.comother.comotlp.arize.compackaging.python.orgpandas.pydata.orgpaulrosen.github.iopeps.python.orgpkg.go.devplatform.claude.complatform.openai.comportswigger.netproto-plus-python.readthedocs.ioprotobuf.devpsycopg.orgpublicsuffix.orgpubs.opengroup.orgpycryptodome.readthedocs.iopydantic-docs.helpmanual.iopydantic.devpydantic.slack.compypi.orgpypi.python.orgpython-devtools.helpmanual.iopython.example.orgpython.orgr.jina.airaw.githubusercontent.comreact.devreact.i18next.comreactjs.orgredis.comredis.ioredis.readthedocs.ioredisearch.ioreferencing.readthedocs.orgrich.readthedocs.ioroadmap.dify.ais3.amazonaws.comschemas.dmtf.orgschemas.openxmlformats.orgscrapethis.comsendgrid.comsethmlarson.devsetuptools.readthedocs.ioshare-na2.hsforms.comsharp.pixelplumbing.comslsa.devsmith.langchain.comsocket.iosome.hostnamespdx.devspdx.orgspec.openapis.orgsphinx-rtd-tutorial.readthedocs.iostackoverflow.comstandards.ieee.orgstatic.zdassets.comstorage.googleapis.comsuperuser.comsupport.atlassian.comsupport.google.comsurrealdb.comsvnbook.red-bean.comsvrintl-g3-aia.verisign.comsvrintl-g3-crl.verisign.comswagger.iotanstack.comtelemetry.googleapis.comtelemetry.mtls.googleapis.comtest.arangodb.comtestca.pythontest.nettinyurl.comtmpl.dify.aitools.ietf.orgtos-cn-beijing.volces.comtrace.wandb.aitracing-analysis-dc-hz.aliyuncs.comtracing.arms.aliyuncs.comtrino.iotyper.tiangolo.comuaparser.devungh.ccunpkg.comupdates.dify.aius-central1-kfp.pkg.devus-kfp.pkg.devus.inference.heroku.comvdb.bj.baidubce.comvector.upstash.iovectordb.tencentcloudapi.comvercel.comvikgc6bnu1s.typeform.comwandb.aiweave-docs.wandb.aiweb.archive.orgwhatwg.orgwicg.github.iowiki.osdev.orgwikipedia.orgwww.actian.comwww.alibabacloud.comwww.anthropic.comwww.apache.orgwww.cacert.orgwww.cockroachlabs.comwww.comet.comwww.couchbase.comwww.cracker.comwww.databricks.comwww.deepseek.comwww.dnspython.orgwww.docs.developers.amplitude.comwww.eclipse.orgwww.elastic.cowww.example.珠宝www.faqs.orgwww.firebirdsql.orgwww.freedesktop.orgwww.gevent.orgwww.gitlab.comwww.google-analytics.comwww.googleapis.comwww.googletagmanager.comwww.haproxy.orgwww.iana.orgwww.ibm.comwww.ietf.orgwww.influxdata.comwww.instantdb.comwww.intersystems.comwww.iso.orgwww.itu.intwww.jsonrpc.orgwww.kernel.orgwww.linuxprogrammingblog.comwww.merriam-webster.comwww.microsoft.comwww.mlflow.orgwww.mongodb.comwww.mysql.comwww.notion.sowww.onlamp.comwww.openssl.orgwww.oracle.comwww.owasp.orgwww.perl.orgwww.perplexity.aiwww.postgresql.orgwww.psycopg.orgwww.python.orgwww.rabbitmq.comwww.rfc-editor.orgwww.sap.comwww.sbert.netwww.sqlite.orgwww.starlette.devwww.structlog.orgwww.tencentcloud.comwww.tensorflow.orgwww.teradata.comwww.volcengine.comwww.w3.orgwww.webmproject.orgwww.xudongz.comwww.youtube.comx.aixn--fiqs8s.icom.museumyour-dify.comyour-region.cls.tencentcs.comzopecomponent.readthedocs.io
</> First-Party Code
first-party (go): dify-agent-runtime
go first-partyexpand_more 41 low-confidence finding(s)
env := os.Environ()Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
home := os.Getenv("HOME")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
cmdutil.HandleError(syscall.Exec(binary, argv, os.Environ()), 126, "exec %s", binary)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
f, err := os.Open(scriptPath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
data, err := os.ReadFile(path)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(tmp, []byte(value+"\n"), 0644); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
outFile, err := os.Create(archivePath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
file, err := os.Open(path)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
outFile, err := os.Create(destPath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(archivePath, archiveBytes, 0o644); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if data, err := os.ReadFile(skillMDPath); err == nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(targetPath, payload, 0o644); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
data, err := os.ReadFile("/dev/stdin")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
data, err := os.ReadFile(absPath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(absPath, []byte(manifest.Note), 0o644); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
data, err := os.ReadFile("/dev/stdin")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
data, err := os.ReadFile(absPath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(destPath, data, 0o644); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
apiURL := strings.TrimSpace(os.Getenv(EnvAPIBaseURL))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
authJWE := strings.TrimSpace(os.Getenv(EnvAuthJWE))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return os.Getenv(EnvAPIBaseURL) != "" && os.Getenv(EnvAuthJWE) != ""Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if v := strings.TrimSpace(os.Getenv(EnvDriveBase)); v != "" {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(destPath, data, 0o644); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
file, err := os.Open(filePath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
v, ok := os.LookupEnv(EnvEnablePathIsolation)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if v, ok := os.LookupEnv(envvar.EnvRWPaths); ok {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if v, ok := os.LookupEnv(envvar.EnvROPaths); ok {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if v, ok := os.LookupEnv(envvar.EnvRWDevPaths); ok {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
f, err := os.Create(readyFile)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
cfg.AuthToken = os.Getenv(DefaultAuthTokenEnv)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if xdg := os.Getenv("XDG_DATA_HOME"); xdg != "" {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
f, err := os.Open(path)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
f, err := os.Open(path)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(scriptPath, []byte(req.Script), 0600); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(envPath, []byte(envJSON), 0600); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(outputPath, []byte{}, 0600); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if err := os.WriteFile(gateFile, []byte{}, 0600); err != nil {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
exitCodeRaw, err := os.ReadFile(exitCodePath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
endedAtRaw, err := os.ReadFile(endedAtPath)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
_ = os.WriteFile(dst, []byte(wrapper), 0755)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
env := os.Environ()Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- @streamdown/math prod — dist-only: no readable source
- jotai-tanstack-form prod — registry 404
- next prod — tarball exceeds byte cap
- motion prod — dist-only: no readable source
- react-papaparse prod — dist-only: no readable source
- react-pdf-highlighter prod — dist-only: no readable source
- dify-agent prod — pypi 404
- sseclient-py prod — no sdist (wheels only)
- flask-migrate prod — scan budget exceeded
- flask-orjson prod — scan budget exceeded
- flask-restx prod — scan budget exceeded
- readabilipy prod — scan budget exceeded
- resend prod — scan budget exceeded
- zstandard prod — scan budget exceeded
- fastopenapi prod — scan budget exceeded
- httpx-sse prod — scan budget exceeded
- json-repair prod — scan budget exceeded
- mysql-connector-python prod — scan budget exceeded
- tidb-vector prod — scan budget exceeded
- qdrant-client prod — scan budget exceeded
- couchbase prod — scan budget exceeded
- opensearch-py prod — scan budget exceeded
- pyobvector prod — scan budget exceeded
- oracledb prod — scan budget exceeded
- elasticsearch prod — scan budget exceeded
- weaviate-client prod — scan budget exceeded
- upstash-vector prod — scan budget exceeded
- pymilvus prod — scan budget exceeded
- pgvector prod — scan budget exceeded
- pgvecto-rs prod — scan budget exceeded
- alibabacloud_gpdb20160503 prod — scan budget exceeded
- alibabacloud_tea_openapi prod — scan budget exceeded
- clickhouse-connect prod — scan budget exceeded
- chromadb prod — scan budget exceeded
- holo-search-sdk prod — scan budget exceeded
- volcengine-compat prod — scan budget exceeded
- tenacity prod — scan budget exceeded
- pymochow prod — scan budget exceeded
- mo-vector prod — scan budget exceeded
- intersystems-irispython prod — scan budget exceeded
- tablestore prod — scan budget exceeded
- tcvectordb prod — scan budget exceeded
- clickzetta-connector-python prod — scan budget exceeded
- opik prod — scan budget exceeded
- weave prod — scan budget exceeded
- langsmith prod — scan budget exceeded
- langfuse prod — scan budget exceeded
- arize-phoenix-otel prod — scan budget exceeded
- mlflow-skinny prod — scan budget exceeded
- github.com/landlock-lsm/go-landlock prod — scan budget exceeded
- github.com/spf13/cobra prod — scan budget exceeded
- google.golang.org/grpc prod — scan budget exceeded
- google.golang.org/protobuf prod — scan budget exceeded
- modernc.org/sqlite prod — scan budget exceeded