Close Open Privacy Scan

link https://github.com/voideditor/void
bolt Snapshot: commit b3166e7
science engine v1.22
schedule 2026-07-23T20:15:55.446876+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy MCP server detected: @anthropic-ai/sdk, @mistralai/mistralai, @modelcontextprotocol/sdk, openai — detected in dependencies, not a safety judgment.

App Privacy Score

92 /100
Low privacy risk

Low risk · 101 finding(s)

Dependency score: 57 (Medium risk)

bar_chart Score Breakdown

egress −5
env_fs −3

list Scan Summary

0 high 0 medium 101 low
First-party packages: 1
Dependency packages: 5
Ecosystem: rust

swap_horiz External domains

aiplatform.googleapis.comaka.msapi.anthropic.comapi.eu.mistral.aiapi.groq.comapi.mistral.aiapi.npms.ioapi.openai.comapi.us.mistral.aiauth.openai.comautopush-generativelanguage.sandbox.googleapis.comavatars.githubusercontent.combatch.chinacloudapi.cnbatch.core.usgovcloudapi.netbatch.core.windows.netbatch.microsoftazure.debrowser.events.data.microsoft.combugzilla.mozilla.orgc.s-microsoft.comchromium.googlesource.comcode.visualstudio.comcompat.spec.whatwg.orgdefault.exp-tas.comdeveloper.mozilla.orgdevelopercertificate.orgdocs.anthropic.comdocs.expo.devdocs.mistral.aidocs.npmjs.comdrafts.csswg.orgdummy.comeducation.github.comen.wikipedia.orgeslint.orggallery.azure.comgallery.chinacloudapi.cngallery.cloudapi.degallery.usgovcloudapi.netgemini-api-demos.uc.r.appspot.comgenerativelanguage.googleapis.comgithub.comgo.microsoft.comgooglechrome.github.iograph.chinacloudapi.cngraph.cloudapi.degraph.windows.nethacks.mozilla.orghelp.openai.comhtml.spec.whatwg.orghttpbin.orghyper.rsinsiders.vscode.devjson-schema.orglearn.microsoft.comlogin.chinacloudapi.cnlogin.microsoftonline.comlogin.microsoftonline.delogin.microsoftonline.uslogin.windows-ppe.netmanage.microsoftazure.demanage.windowsazure.usmanagement.azure.commanagement.chinacloudapi.cnmanagement.core.chinacloudapi.cnmanagement.core.cloudapi.demanagement.core.usgovcloudapi.netmanagement.core.windows.netmanagement.microsoftazure.demanagement.usgovcloudapi.netmathiasbynens.github.iomicrosoft.commicrosoft.github.ionews.google.comnpm.imollama.comontheline.trincoll.eduplatform.claude.complatform.openai.compnpm.ioportal.azure.cnportal.azure.comportal.azure.usportal.microsoftazure.deposthog.comr12a.github.ioraw.githubusercontent.comreact.devreactjs.orgregistry.bower.ioregistry.npmjs.comregistry.npmjs.orgsass-lang.comschema.orgsemver.orgsentry.iostackoverflow.comstorage.googleapis.comtools.ietf.orgupdate.code.visualstudio.comus.i.posthog.comvscode.devvscode.download.prss.microsoft.comwww.allrecipes.comwww.ecma-international.orgwww.foodnetwork.comwww.freedesktop.orgwww.gnu.orgwww.googleapis.comwww.ibm.comwww.ietf.orgwww.w3.org

</> First-Party Code

first-party (rust): cli

rust first-party
expand_more 27 low-confidence finding(s)
low env_fs production #4e8123b1f1d0d8c1 — Filesystem access.
repo/cli/build.rs:107 
	let mut file = fs::File::open(path).expect("failed to open file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eb564daec2fa8c3c — Environment-variable access.
repo/cli/build.rs:129 
	match env::var("VSCODE_CLI_PRODUCT_JSON") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d8c021890acd073 — Filesystem access.
repo/cli/build.rs:158 
		let contents = fs::read(file)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #7b111fdf4782241f — Hardcoded external endpoint. Review what data is sent to this destination.
repo/cli/src/auth.rs:122 
	client
		.get(GH_USER_ENDPOINT)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #3be6df89d0216b57 — Environment-variable access.
repo/cli/src/auth.rs:200 
	if std::env::var("VSCODE_CLI_DISABLE_KEYCHAIN_ENCRYPT").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a1fcd31ff1411f82 — Environment-variable access.
repo/cli/src/auth.rs:411 
		let native_storage_result = if std::env::var("VSCODE_CLI_USE_FILE_KEYCHAIN").is_ok()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a13376a842238b30 — Filesystem access.
repo/cli/src/commands/serve_web.rs:75 
			let token = fs::read_to_string(PathBuf::from(p))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4fa0e99f9752852d — Environment-variable access.
repo/cli/src/desktop/version_manager.rs:374 
	let path = match std::env::var("PATH") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #61a08a89b082f5e5 — Filesystem access.
repo/cli/src/desktop/version_manager.rs:429 
		let mut binary_file = File::create(binary_file_path).expect("expected to make file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e5fa82e342d39745 — Filesystem access.
repo/cli/src/desktop/version_manager.rs:507 
			File::create(&path).expect("expected to create file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1239ff4733f91969 — Filesystem access.
repo/cli/src/desktop/version_manager.rs:518 
				let mut f = File::create(&path).expect("expected to create file");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d30ba411e7556f08 — Filesystem access.
repo/cli/src/tunnels/code_server.rs:378 
		let contents = fs::read_to_string(&self.server_paths.logfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc8fdc10a021662e — Filesystem access.
repo/cli/src/tunnels/code_server.rs:629 
		File::create(&self.server_paths.logfile).map_err(|e| {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2ea014a393d733fc — Environment-variable access.
repo/cli/src/tunnels/control_server.rs:1046 
		env: std::env::vars().collect(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1105821aca511af9 — Filesystem access.
repo/cli/src/tunnels/service.rs:84 
	let file = std::fs::File::open(log_file).map_err(|e| wrap(e, "error opening log file"))?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #199446a7c4d80be9 — Environment-variable access.
repo/cli/src/tunnels/service_linux.rs:117 
		if std::env::var("SSH_CLIENT").is_ok() || std::env::var("SSH_TTY").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9ebc49717908ce54 — Filesystem access.
repo/cli/src/tunnels/service_linux.rs:199 
	let mut f = File::create(path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97bad488a803314e — Filesystem access.
repo/cli/src/tunnels/service_macos.rs:134 
	let mut f = File::create(path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99fb388f9da00308 — Environment-variable access.
repo/cli/src/tunnels/service_windows.rs:96 
		if std::env::var(DID_LAUNCH_AS_HIDDEN_PROCESS).is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1e55e9f8f817afe1 — Environment-variable access.
repo/cli/src/tunnels/wsl_detect.rs:20 
		let sys_root = match std::env::var("SystemRoot") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #33f97e1b6633d485 — Environment-variable access.
repo/cli/src/tunnels/wsl_detect.rs:25 
		let is_32_on_64 = std::env::var("PROCESSOR_ARCHITEW6432").is_ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #abbb5cbf1a977b49 — Environment-variable access.
repo/cli/src/util/errors.rs:426 
		if std::env::var("WSL_DISTRO_NAME").is_ok() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df77b1de684a51ac — Filesystem access.
repo/cli/src/util/io.rs:283 
		let mut append_file = File::create(&file_path).unwrap(); // truncates

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6602d247d2cbe4f7 — Environment-variable access.
repo/cli/src/util/machine.rs:84 
		std::env::var_os("SNAP"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #693ae1217b75a522 — Environment-variable access.
repo/cli/src/util/machine.rs:85 
		std::env::var_os("SNAP_REVISION"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de3975f690836892 — Environment-variable access.
repo/cli/src/util/prereqs.rs:190 
	std::env::var("VSCODE_SERVER_CUSTOM_GLIBC_LINKER").is_ok() ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c6e9d2fdfc415b1 — Filesystem access.
repo/cli/src/util/prereqs.rs:222 
		Some(path) => match fs::read(&path).await {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

flate2

rust dependency
expand_more 9 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #129e92d81676a49b — Filesystem access.
pkgs/rust/[email protected]/examples/compress_file.rs:14 
    let mut input = BufReader::new(File::open(args().nth(1).unwrap()).unwrap());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b0fd737873b9127d — Filesystem access.
pkgs/rust/[email protected]/examples/compress_file.rs:15 
    let output = File::create(args().nth(2).unwrap()).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9815997294fdeddf — Filesystem access.
pkgs/rust/[email protected]/examples/decompress_file.rs:14 
    let input = BufReader::new(File::open(args().nth(1).unwrap()).unwrap());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #196c277aeaa56f88 — Filesystem access.
pkgs/rust/[email protected]/examples/decompress_file.rs:15 
    let mut output = File::create(args().nth(2).unwrap()).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #98e81cb73dc3f693 — Filesystem access.
pkgs/rust/[email protected]/examples/deflateencoder-bufread.rs:16 
    let f = File::open("examples/hello_world.txt")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ede44dfb7879f1a0 — Filesystem access.
pkgs/rust/[email protected]/examples/gzbuilder.rs:14 
    let f = File::create("examples/hello_world.txt.gz")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #71014143170678c2 — Filesystem access.
pkgs/rust/[email protected]/examples/gzencoder-bufread.rs:16 
    let f = File::open("examples/hello_world.txt")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6b6997da6bba040e — Filesystem access.
pkgs/rust/[email protected]/examples/zlibencoder-bufread.rs:16 
    let f = File::open("examples/hello_world.txt")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f9c6c610df45e0af — Filesystem access.
pkgs/rust/[email protected]/examples/zlibencoder-read.rs:14 
    let f = File::open("examples/hello_world.txt")?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

reqwest

rust dependency
expand_more 49 low-confidence finding(s)
low egress tooling Excluded from app score unknown #78dc7d192d2e1ac4 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/examples/form.rs:9 
    let response = reqwest::Client::new()
        .post("http://www.baidu.com")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #eea6e0221509295d — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/examples/json_dynamic.rs:12 
    let echo_json: serde_json::Value = reqwest::Client::new()
        .post("https://jsonplaceholder.typicode.com/posts")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #65494e9ff360a102 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/examples/json_typed.rs:30 
    let new_post: Post = reqwest::Client::new()
        .post("https://jsonplaceholder.typicode.com/posts")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #41d97f2f6955e1e5 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/examples/tor_socks.rs:15 
    let res = client.get("https://check.torproject.org").send().await?;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low telemetry dependency Excluded from app score #2d4436c607c537a9 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/async_impl/client.rs:496 
                                    log::warn!(
                                        "rustls failed to parse DER certificate {err:?} {cert:?}"
                                    );

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low egress dependency Excluded from app score #6967899d80ff28c0 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:662 
        let r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #824d0e79ea8db10a — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:675 
        let r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bc8cbd61c3c9ee86 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:693 
        let r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a3bb4b720a744c7 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:714 
        let r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d768c925775104aa — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:731 
        let req = client
            .get("https://hyper.rs")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df83f00be2cbd588 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:753 
        let req = client
            .get(some_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1cfb2a80ca14f027 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:766 
        let builder = client
            .post("http://httpbin.org/post")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3043dc678a197763 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:783 
        let builder = client.get("http://httpbin.org/get");

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6c3650bc110744df — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:800 
        let builder = client
            .get("http://httpbin.org/get")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0072fe61c1d9e7e5 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:812 
        let req = client.get(some_url).build().expect("request build");

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c3bdb9b78f429629 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/async_impl/request.rs:917 
            client.get("http://example.com")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #ce16217caa05e873 — Filesystem access.
pkgs/rust/[email protected]/src/blocking/multipart.rs:225 
        let file = File::open(path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9964375f0d245820 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:675 
        let r = client.get(some_url).build().unwrap();

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e355213de4bdfe56 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:695 
        let r = client.post(some_url).build().unwrap();

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c660a1745c15a03 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:705 
        let r = client.put(some_url).build().unwrap();

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df2bcb984bb468ad — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:735 
        let r = client.post(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4edbb866f4552ac6 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:750 
        let r = client.post(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2ea43864e982819d — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:768 
        let r = client.post(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #25eb693a3804ff88 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:792 
        let r = client.post(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #acfa12c26e2204b3 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:807 
        let mut r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7c48513892ea5750 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:820 
        let mut r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5cf77a1b6cba707 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:838 
        let mut r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c8686ad82ab4f10 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:859 
        let mut r = client.get(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13dc3c211e9693bb — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:871 
        let r = client.post(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #19902bf76c200f4e — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:895 
        let r = client.post(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cc945775ec71d941 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:929 
        let r = client.post(some_url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #464628f9f9d48255 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:945 
        let req = client
            .get("https://hyper.rs")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3001594f10d8b919 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:967 
        let req = client
            .get(some_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #452d020bc115cd52 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/blocking/request.rs:982 
        let req = client.get(some_url).build().expect("request build");

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low telemetry dependency Excluded from app score #067f2d156277f1bc — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/connect.rs:320 
        log::debug!("proxy({proxy_scheme:?}) intercepts '{dst:?}'");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #8cd2cf4e7d32f596 — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/connect.rs:449 
        log::debug!("starting new connection: {dst:?}");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low telemetry dependency Excluded from app score #bbf70c85d7fc2fff — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/connect.rs:694 
        log::debug!("tunnel to {host}:{port} using basic auth");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #5e886a15178cc45f — Environment-variable access.
pkgs/rust/[email protected]/src/proxy.rs:452 
        let raw = env::var("NO_PROXY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7da3ccf3503aeaab — Environment-variable access.
pkgs/rust/[email protected]/src/proxy.rs:453 
            .or_else(|_| env::var("no_proxy"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1460274bd603c444 — Environment-variable access.
pkgs/rust/[email protected]/src/proxy.rs:901 
        if log::log_enabled!(log::Level::Warn) && env::var_os("HTTP_PROXY").is_some() {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low telemetry dependency Excluded from app score #be03f2a238e7fd6d — Log/trace emission. Structured logs can carry PII to sinks/aggregators.
pkgs/rust/[email protected]/src/proxy.rs:902 
            log::warn!("HTTP_PROXY environment variable ignored in CGI");

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
low env_fs dependency Excluded from app score #80678a081d1c5b56 — Environment-variable access.
pkgs/rust/[email protected]/src/proxy.rs:923 
    if let Ok(val) = env::var(var) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25969992f6068037 — Environment-variable access.
pkgs/rust/[email protected]/src/proxy.rs:935 
    env::var_os("REQUEST_METHOD").is_some()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07f7207f24a36bf2 — Environment-variable access.
pkgs/rust/[email protected]/src/proxy.rs:1629 
        let orig_val = env::var(&name).ok();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #4ac8d1fbae510ca3 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/wasm/client.rs:351 
        let mut req = client
            .get("https://www.example.com")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98cc832c201d5377 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/wasm/client.rs:376 
        let mut req = client
            .get("https://www.example.com")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa71f6471d930354 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/wasm/client.rs:392 
        let mut req2 = client
            .get("https://www.example.com/x")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e4d7f1fec2d53ca — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/wasm/client.rs:414 
        let mut req = client
            .get("https://www.example.com")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #24a5063889be6927 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/rust/[email protected]/src/wasm/client.rs:432 
        let mut req2 = client
            .get("https://www.example.com")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

slog

rust dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #8461f00de34f3efd — Environment-variable access.
pkgs/rust/[email protected]/build.rs:30 
    let target = env::var("TARGET").unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tokio

rust dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #fedbe59b51803654 — Filesystem access.
pkgs/rust/[email protected]/src/fs/file.rs:154 
        let std = asyncify(|| StdFile::open(path)).await?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c393ef19d917d387 — Filesystem access.
pkgs/rust/[email protected]/src/fs/file.rs:192 
        let std_file = asyncify(move || StdFile::create(path)).await?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6eeca59d8946105 — Filesystem access.
pkgs/rust/[email protected]/src/fs/read.rs:48 
    asyncify(move || std::fs::read(path)).await

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14da6a7f7ecd11f5 — Filesystem access.
pkgs/rust/[email protected]/src/fs/read_to_string.rs:29 
    asyncify(move || std::fs::read_to_string(path)).await

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2d8f44032194da2 — Filesystem access.
pkgs/rust/[email protected]/src/fs/write.rs:30 
    asyncify(move || std::fs::write(path, contents)).await

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f1f9adf5ad59264 — Environment-variable access.
pkgs/rust/[email protected]/src/loom/std/mod.rs:89 
        match std::env::var(ENV_WORKER_THREADS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

zip

rust dependency
expand_more 9 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #43ec42d4bc36fc0a — Filesystem access.
pkgs/rust/[email protected]/examples/extract.rs:15 
    let file = fs::File::open(fname).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #179c7dabe5303d3a — Filesystem access.
pkgs/rust/[email protected]/examples/extract.rs:48 
            let mut outfile = fs::File::create(&outpath).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #02975e5ebd63c8d9 — Filesystem access.
pkgs/rust/[email protected]/examples/extract_lorem.rs:14 
    let zipfile = std::fs::File::open(fname).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9b9672e2eb541318 — Filesystem access.
pkgs/rust/[email protected]/examples/file_info.rs:15 
    let file = fs::File::open(fname).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6d83665cbb071631 — Filesystem access.
pkgs/rust/[email protected]/examples/write_dir.rs:90 
            let mut f = File::open(path)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a6ca1bfebf43e8bc — Filesystem access.
pkgs/rust/[email protected]/examples/write_dir.rs:117 
    let file = File::create(path).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8e83bf80ced6ce26 — Filesystem access.
pkgs/rust/[email protected]/examples/write_sample.rs:26 
    let file = std::fs::File::create(path).unwrap();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab78cb9b3628e2aa — Filesystem access.
pkgs/rust/[email protected]/src/read.rs:467 
                let mut outfile = fs::File::create(&outpath)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1af078c3ec72f42 — Filesystem access.
pkgs/rust/[email protected]/src/read/stream.rs:76 
                    let mut outfile = fs::File::create(&outpath)?;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @vscode/deviceid prod — dist-only: no readable source
  • vscode-markdown-languageserver prod — dist-only: no readable source
  • @vscode/l10n prod — dist-only: no readable source
  • slog-async prod — no rust source in crate
  • lazy_static prod — scan budget exceeded
  • sysinfo prod — scan budget exceeded
  • serde prod — scan budget exceeded
  • serde_json prod — scan budget exceeded
  • rmp-serde prod — scan budget exceeded
  • uuid prod — scan budget exceeded
  • dirs prod — scan budget exceeded
  • rand prod — scan budget exceeded
  • opentelemetry prod — scan budget exceeded
  • serde_bytes prod — scan budget exceeded
  • chrono prod — scan budget exceeded
  • gethostname prod — scan budget exceeded
  • libc prod — scan budget exceeded
  • tunnels prod — scan budget exceeded
  • keyring prod — scan budget exceeded
  • dialoguer prod — scan budget exceeded
  • hyper prod — scan budget exceeded
  • indicatif prod — scan budget exceeded
  • tempfile prod — scan budget exceeded
  • clap_lex prod — scan budget exceeded
  • url prod — scan budget exceeded
  • async-trait prod — scan budget exceeded
  • log prod — scan budget exceeded
  • const_format prod — scan budget exceeded
  • sha2 prod — scan budget exceeded
  • base64 prod — scan budget exceeded
  • shell-escape prod — scan budget exceeded
  • thiserror prod — scan budget exceeded
  • cfg-if prod — scan budget exceeded
  • pin-project prod — scan budget exceeded
  • console prod — scan budget exceeded
  • bytes prod — scan budget exceeded
  • tar prod — scan budget exceeded