Close Open Privacy Scan
App Privacy Score
Low risk · 93 finding(s)
Based on: 2 first-party package(s) · 25/25 deps analyzed
Dependency score: 77 (Medium risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz Application data flows
No application data flows were found. See dependency data flows below.
hub Dependency data flows (1)
- 1source
pkgs/go/[email protected]/examples/server/distributed/main.go:91 - 2sink
pkgs/go/[email protected]/examples/server/distributed/main.go:97
</> First-Party Code
first-party (go)
go first-partyexpand_more 21 low-confidence finding(s)
low env_fs — Filesystem access. 15 locations
low env_fs — Environment-variable access. 6 locations
</> Dependencies
github.com/modelcontextprotocol/go-sdk
go dependency log.Printf("child %d failed: %v", i, err)PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 7 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
low env_fs — Filesystem access. 2 locations
github.com/google/go-github/v89
go dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 6 locations
github.com/google/jsonschema-go
go dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
github.com/josephburnett/jd/v2
go dependencyexpand_more 16 low-confidence finding(s)
low env_fs — Filesystem access. 15 locations
gitHubOutput := os.Getenv("GITHUB_OUTPUT")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
github.com/shurcooL/githubv4
go dependencyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
err = os.WriteFile(filename, out, 0644)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
req, err := http.NewRequest("GET", "https://api.github.com/graphql", nil)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.