Close Open Privacy Scan

link https://github.com/sgl-project/sglang
bolt Snapshot: commit 559854f
science engine v3
schedule 2026-07-10T15:07:08.548967+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

App Privacy Score

97 /100
Low privacy risk

Low risk · 102 finding(s)

Dependency score: 82 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 1 medium 101 low
First-party packages: 2
Dependency packages: 5
Ecosystem: go

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)
medium google.golang.org/protobuf dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:517 → pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:520

</> First-Party Code

first-party (go): sgl-model-gateway/bindings/golang

go first-party
expand_more 11 low-confidence finding(s)
low env_fs production #21101a4a8d692010 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:19 
	tokenizerPath := os.Getenv("SGL_TOKENIZER_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dfb10f98d0aef949 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:25 
	endpoint := os.Getenv("SGL_GRPC_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5f975fd4a4bd5a39 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:31 
	port := os.Getenv("PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fd0eebb31f9f8b73 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:37 
	logDir := os.Getenv("LOG_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b276ee392d5eb27 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:43 
	logLevel := os.Getenv("LOG_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e1f3654b001c5d6b — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/main.go:54 
	if os.Getenv("PPROF_ENABLED") == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a0dc31ee5e4de55f — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/main.go:55 
		pprofPort := os.Getenv("PPROF_PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b5361fe7b832a56 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/simple/main.go:15 
	endpoint := os.Getenv("SGL_GRPC_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #270a224d9d86402e — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/simple/main.go:20 
	tokenizerPath := os.Getenv("SGL_TOKENIZER_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c9c65df4b71b1542 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/streaming/main.go:18 
	endpoint := os.Getenv("SGL_GRPC_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #798f27c9b831044e — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/streaming/main.go:23 
	tokenizerPath := os.Getenv("SGL_TOKENIZER_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (go): sgl-model-gateway/bindings/golang/examples/oai_server

go first-party
expand_more 7 low-confidence finding(s)
low env_fs production #21101a4a8d692010 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:19 
	tokenizerPath := os.Getenv("SGL_TOKENIZER_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dfb10f98d0aef949 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:25 
	endpoint := os.Getenv("SGL_GRPC_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5f975fd4a4bd5a39 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:31 
	port := os.Getenv("PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fd0eebb31f9f8b73 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:37 
	logDir := os.Getenv("LOG_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b276ee392d5eb27 — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/config/config.go:43 
	logLevel := os.Getenv("LOG_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e1f3654b001c5d6b — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/main.go:54 
	if os.Getenv("PPROF_ENABLED") == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a0dc31ee5e4de55f — Environment-variable access.
repo/sgl-model-gateway/bindings/golang/examples/oai_server/main.go:55 
		pprofPort := os.Getenv("PPROF_PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

google.golang.org/protobuf

go dependency
medium pii_flow dependency Excluded from app score #a783e610def769ea — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:520 · flow /tmp/closeopen-a41gdloy/pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:517 → /tmp/closeopen-a41gdloy/pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:520 
		fmt.Printf("executing: %v\n%s\n", strings.Join(cmd.Args, " "), out)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 22 low-confidence finding(s)
low env_fs dependency Excluded from app score #e675cb2e9cb449b6 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:117 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/wirefuzz/corpus/%x", sha1.Sum(wire)), wire, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #611471aa003d6430 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:125 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/textfuzz/corpus/%x", sha1.Sum(text)), text, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3a943b6258f9141 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:133 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/jsonfuzz/corpus/%x", sha1.Sum(json)), json, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b975a6c86c6863a4 — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:46 
	if plugin := os.Getenv("RUN_AS_PROTOC_PLUGIN"); plugin != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c419817637f647d9 — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:85 
	flag.StringVar(&protoRoot, "protoroot", os.Getenv("PROTOBUF_ROOT"), "The root of the protobuf source tree.")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78869fd381055627 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:119 
	out, err := os.Create(outFn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5ace96b77ae085e — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:124 
	b, err := os.ReadFile(inFn)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #067c7b1f076c369f — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:424 
			check(os.WriteFile(filepath.Join(tmpDir, filepath.FromSlash(d.path+"/gen_test.go")), b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bbf19b28a861936 — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:517 
	cmd.Env = append(os.Environ(), "RUN_AS_PROTOC_PLUGIN=1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3949ec14c593b7b — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:718 
	src, err := os.ReadFile(srcPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #deb5d78373943863 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:721 
	dst, _ := os.ReadFile(dstPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59fe90696b4a7bcf — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:725 
	check(os.WriteFile(dstPath, src, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ab9479f2b2148f6 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:263 
		prev, _ := os.ReadFile(absFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d784992e3c69cba — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:266 
			check(os.WriteFile(absFile, b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #025d4f0f6f2e6028 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:269 
		check(os.WriteFile(absFile+".tmp", b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2ec8728a5da532e — Filesystem access.
pkgs/go/[email protected]/internal/cmd/pbdump/pbdump.go:121 
		b, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0df61f577e4a4cdd — Filesystem access.
pkgs/go/[email protected]/internal/detrand/rand.go:46 
	f, err := os.Open(s)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68f4e5cc64ff2a1c — Filesystem access.
pkgs/go/[email protected]/internal/fuzztest/fuzztest.go:20 
	dir, err := os.Open(*corpus)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d82b9e54b907adfe — Filesystem access.
pkgs/go/[email protected]/internal/fuzztest/fuzztest.go:36 
			b, err := os.ReadFile(filepath.Join(*corpus, name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d231dde1ec2dc52 — Environment-variable access.
pkgs/go/[email protected]/internal/impl/lazy.go:24 
	if os.Getenv("GOPROTODEBUG") == "nolazy" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d88a5a7802f742dd — Environment-variable access.
pkgs/go/[email protected]/reflect/protoregistry/registry.go:51 
	if v := os.Getenv(env); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #655c65baebe41840 — Environment-variable access.
pkgs/go/[email protected]/reflect/protoregistry/registry.go:63 
		panic("invalid " + env + " value: " + os.Getenv(env))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/valyala/fasthttp

go dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #470f9a47d06cbae4 — Filesystem access.
pkgs/go/[email protected]/bytesconv_table_gen.go:130 
	if err := os.WriteFile("bytesconv_table.go", w.Bytes(), 0o660); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9309c45217728296 — Filesystem access.
pkgs/go/[email protected]/fs.go:1401 
	zf, err := os.Create(tmpFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04c4ed3d02f9f054 — Filesystem access.
pkgs/go/[email protected]/fs.go:1682 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4470654e3e6db7d5 — Filesystem access.
pkgs/go/[email protected]/fs.go:1710 
func (o *osFS) Open(name string) (fs.File, error)     { return os.Open(name) }

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66179db88ab88fcc — Filesystem access.
pkgs/go/[email protected]/http.go:197 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0424dfc1c1084a8d — Filesystem access.
pkgs/go/[email protected]/server.go:1090 
	if ff, err = os.Create(path); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.uber.org/zap

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #313354d314a16906 — Environment-variable access.
pkgs/go/[email protected]/internal/ztest/timeout.go:55 
	if v := os.Getenv("TEST_TIMEOUT_SCALE"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google.golang.org/grpc

go dependency
expand_more 49 low-confidence finding(s)
low env_fs dependency Excluded from app score #1546f0b0ebf5b6b6 — Filesystem access.
pkgs/go/[email protected]/authz/grpc_authz_server_interceptors.go:143 
	policyContents, err := os.ReadFile(i.policyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e7580b4e9fddb825 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:961 
		f, err := os.Create(opts.cpuProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0ef776214cd3cf59 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:979 
		f, err := os.Create(opts.memProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #710bd11929986b33 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:992 
		f, err := os.Create(opts.benchmarkResultFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9ed91a413d513460 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchresult/main.go:44 
	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9e9f3b6bab6858a3 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchresult/main.go:117 
	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7d036adf35a58335 — Filesystem access.
pkgs/go/[email protected]/benchmark/client/main.go:104 
	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #876166a38fce4dcc — Filesystem access.
pkgs/go/[email protected]/benchmark/client/main.go:117 
	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7ac5e92afb301321 — Filesystem access.
pkgs/go/[email protected]/benchmark/server/main.go:66 
	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2f9542580b8084f3 — Filesystem access.
pkgs/go/[email protected]/benchmark/server/main.go:85 
	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7e727888bef1b3ae — Filesystem access.
pkgs/go/[email protected]/benchmark/stats/curve.go:83 
	data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #09204cbaa6efbc1f — Filesystem access.
pkgs/go/[email protected]/benchmark/stats/curve.go:104 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9bf8e3c9069da70 — Filesystem access.
pkgs/go/[email protected]/credentials/jwt/file_reader.go:50 
	tokenBytes, err := os.ReadFile(r.tokenFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3580524939759a26 — Filesystem access.
pkgs/go/[email protected]/credentials/oauth/oauth.go:76 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #788ea81f89ab2c2d — Filesystem access.
pkgs/go/[email protected]/credentials/oauth/oauth.go:195 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b260de854579d03 — Filesystem access.
pkgs/go/[email protected]/credentials/tls.go:282 
	b, err := os.ReadFile(certFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52190b2a46d91e3f — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:164 
	certFileContents, err := os.ReadFile(w.opts.CertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8143f28863b9a8bd — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:169 
	keyFileContents, err := os.ReadFile(w.opts.KeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e62afcc3e5fb49f — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:211 
	spiffeBundleMapContents, err := os.ReadFile(w.opts.SPIFFEBundleMapFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16577b273ea92ef6 — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:230 
	rootFileContents, err := os.ReadFile(w.opts.RootFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d588548007be7d3 — Filesystem access.
pkgs/go/[email protected]/experimental/credentials/tls.go:199 
	b, err := os.ReadFile(certFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fcdebe0e7d0be84 — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:65 
	logLevel := os.Getenv("GRPC_GO_LOG_SEVERITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f9f2531d78301f7 — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:76 
	vLevel := os.Getenv("GRPC_GO_LOG_VERBOSITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0bf9f4e066d0401 — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:81 
	jsonFormat := strings.EqualFold(os.Getenv("GRPC_GO_LOG_FORMATTER"), "json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #985fbbc486446ccf — Environment-variable access.
pkgs/go/[email protected]/internal/binarylog/binarylog.go:77 
	configStr := os.Getenv(envStr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60b32d913d7508f1 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:85 
		return !strings.EqualFold(os.Getenv(envVar), "false")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b27b6a238429fce — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:88 
	return strings.EqualFold(os.Getenv(envVar), "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9325ef2d44b7cac — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:92 
	v, err := strconv.ParseUint(os.Getenv(envVar), 10, 64)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7bbe8412fe0023a — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/observability.go:34 
	ObservabilityConfig = os.Getenv(envObservabilityConfig)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4bd8c77b4cd6057 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/observability.go:41 
	ObservabilityConfigFile = os.Getenv(envObservabilityConfigFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18f691205ae9b255 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:46 
	XDSBootstrapFileName = os.Getenv(XDSBootstrapFileNameEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e6d2d3c6c03238e — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:52 
	XDSBootstrapFileContent = os.Getenv(XDSBootstrapFileContentEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93121c3ee85a3020 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:55 
	C2PResolverTestOnlyTrafficDirectorURI = os.Getenv("GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75e5baa1ec573af6 — Filesystem access.
pkgs/go/[email protected]/internal/googlecloud/manufacturer_linux.go:26 
	return os.ReadFile(linuxProductNameFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #274c628aaa58dd05 — Environment-variable access.
pkgs/go/[email protected]/internal/grpctest/tlogger.go:78 
	if vLevelEnv, found := os.LookupEnv("GRPC_GO_LOG_VERBOSITY_LEVEL"); found {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89c5342abf213293 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:39 
	b, err := os.ReadFile(testdata.Path("x509/server_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52ba931e6a30c293 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:63 
	b, err := os.ReadFile(testdata.Path("x509/client_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a461a18f758f5fff — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:89 
	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90785f20c70ee24c — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:115 
	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f4819baa3acd60a — Filesystem access.
pkgs/go/[email protected]/internal/testutils/tls_creds.go:143 
	b, err := os.ReadFile(testdata.Path("spiffe_end2end/ca.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7512906621ea5054 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/bootstrap.go:157 
	data, err := os.ReadFile(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6449e7d87c9e9e68 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/bootstrap.go:161 
	if err := os.WriteFile(dst, data, os.ModePerm); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e0f0b7d9b4634c2 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds_bootstrap.go:42 
	if err := os.WriteFile(f.Name(), bootstrapContents, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc66f67e06268b11 — Filesystem access.
pkgs/go/[email protected]/interop/client/client.go:222 
			b, err := os.ReadFile(*caFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e8bd754b50beb59 — Filesystem access.
pkgs/go/[email protected]/interop/test_utils.go:285 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec7e1ed804642fd5 — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/catapult.go:378 
	streamStatsCatapultJSONFile, err := os.Create(streamStatsCatapultJSONFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cdebb818d5f16cc — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/local.go:29 
	snapshotFile, err := os.Open(snapshotFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cc2a6d872c3e187 — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/remote.go:54 
	file, err := os.Create(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61282a46ffbbc8b3 — Environment-variable access.
pkgs/go/[email protected]/stats/opentelemetry/csm/pluginoption.go:168 
	if val, ok := os.LookupEnv(name); ok {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gopkg.in/natefinch/lumberjack.v2

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #cd713be875dc8ef8 — Filesystem access.
pkgs/go/[email protected]/chown_linux.go:12 
	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a3fd74c1d2a1b5a — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:235 
	f, err := os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ab43f5755bbd8d6 — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:280 
	file, err := os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cecfb3fb6829644c — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:469 
	f, err := os.Open(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6bc2c9af592d038f — Filesystem access.
pkgs/go/[email protected]/lumberjack.go:486 
	gzf, err := os.OpenFile(dst, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, fi.Mode())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • github.com/sglang/sglang-go-grpc-sdk prod — proxy 404