Close Open Privacy Scan

link https://github.com/samanhappy/mcphub

bolt Snapshot: commit cb44e22

science engine v1.22

schedule 2026-07-22T18:11:06.583171+00:00

smart_toy MCP server detected: @modelcontextprotocol/sdk, openai — detected in dependencies, not a safety judgment.

App Privacy Score

82 /100

Low privacy risk

Low risk · 1331 finding(s)

Dependency score: 22 (High risk)

bar_chart Score Breakdown

egress −15

env_fs −3

list Scan Summary

1 high 110 medium 1220 low

First-party packages: 1

Dependency packages: 19

Ecosystem: npm

swap_horiz Application data flows

External domains: aiplatform.googleapis.comapi.mcprouter.toapi.openai.comapi.siliconflow.cnauth.openai.comautopush-generativelanguage.sandbox.googleapis.comcookbook.openai.comdevelopers.openai.comdiscord.ggdocs.expo.devdocs.mcphub.appdummy.comexpress-rate-limit.github.iogemini-api-demos.uc.r.appspot.comgenerativelanguage.googleapis.comgithub.comhelp.openai.comhf-mirror.comhuggingface.cojson-schema.orgko-fi.comlogin.microsoftonline.commanagement.azure.commcphub.localmcpm.shmcprouter.cometadata.google.internalnews.google.comnpm.imontheline.trincoll.eduopenrouter.aipetstore.swagger.ioplatform.openai.compypi.orgraw.githubusercontent.comredis.azure.comregistry.modelcontextprotocol.ioregistry.npmjs.orgstorage.googleapis.comwww.allrecipes.comwww.foodnetwork.comwww.googleapis.comwww.mcphub.appwww.w3.orgyour_resource_name.openai.azure.com

medium first-party (npm) A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

repo/src/services/vectorSearchService.ts:106 → repo/src/services/vectorSearchService.ts:105

hub Dependency data flows (110)

high hono tooling User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

pkgs/npm/[email protected]__reposrc/runtime-tests/node/index.test.ts:236 → pkgs/npm/[email protected]__reposrc/runtime-tests/node/index.test.ts:236

medium axios dependency Credentials parsed from the request URL are applied as authorization on the same outbound HTTP request. This is intentional URL authentication, not unexpected data exfiltration.

pkgs/npm/[email protected]/lib/adapters/http.js:861 → pkgs/npm/[email protected]/lib/adapters/http.js:1062

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:27

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:19

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:19

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:83

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:103

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:109

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:117

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:124

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:133

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:161

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:163

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:52

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:66

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:76

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:80

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:82

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:84

medium @google/genai dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:296 → pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:307

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:15 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:76

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:15 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:84

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:15 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:87

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:19

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:21

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:25

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:36

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:42

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:46

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:21

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/direct_url.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/direct_url.ts:23

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:21

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:25

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:34

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:40

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:47

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:59

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:76

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:96

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:97

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:118

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:131

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:16 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:80

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:9 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:31

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:25

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:26

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:32

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:58

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:13 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:55

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:10 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:52

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:29

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:24

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:27

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:38

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:9 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:42

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:13 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:36

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:23

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:20

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:19

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text_vertex_apikey.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text_vertex_apikey.ts:20

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:24

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:26

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:24

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:36

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_basic.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_basic.ts:19

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:70

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:56

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:19

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:22

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:38

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:8

→

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:42

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:8

→

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:66

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:38

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:8

→

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:41

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:8

→

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:64

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:55

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:52

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:22

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:31

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:34

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:54

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_structured_output_json.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_structured_output_json.ts:22

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_code_execution.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_code_execution.ts:21

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_computer_use.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_computer_use.ts:22

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_functions.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_functions.ts:52

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_google_search.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_google_search.ts:21

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mcp_server.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mcp_server.ts:29

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mime_type.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mime_type.ts:49

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_url_context.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_url_context.ts:22

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_with_config.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_with_config.ts:21

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:13 → pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:184

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_ephemeral.ts:13 → pkgs/npm/@[email protected]__reposrc/sdk-samples/live_ephemeral.ts:152

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:9 → pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:37

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:9 → pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:45

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:41

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:44

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:46

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:52

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:61

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:69

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:76

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:80

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:85

medium @google/genai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:89

</> First-Party Code

first-party (npm)

npm first-party

medium pii_flow production #838a8730ce9cdae8 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

repo/src/services/vectorSearchService.ts:105 · flow /tmp/closeopen-imo_y475/repo/src/services/vectorSearchService.ts:106 → /tmp/closeopen-imo_y475/repo/src/services/vectorSearchService.ts:105

      headers: {
        'api-key': azureConfig.apiKey,
        'Content-Type': 'application/json',
      },

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

expand_more 192 low-confidence finding(s)

low env_fs production #499c41417cd6d165 — Filesystem access.

repo/bin/cli.js:5

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1abf4a0ded66e295 — Environment-variable access.

repo/bin/cli.js:36

  const isDebug = process.env.DEBUG === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1258ed452072f567 — Filesystem access.

repo/bin/cli.js:56

        const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0ef3ff4656db47cd — Environment-variable access.

repo/frontend/src/contexts/ServerContext.tsx:104

  const MIN_REFRESH_INTERVAL = process.env.NODE_ENV === 'development' ? 5000 : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a7a2e717445d6d80 — Environment-variable access.

repo/frontend/src/i18n.ts:33

    debug: process.env.NODE_ENV === 'development',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #5354adc78b416b60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/frontend/src/services/betterAuthClient.ts:41

  const response = await fetch(`${resolveBaseUrl(basePathOverride)}/sign-in/oauth2`, {
    method: 'POST',
    credentials: 'include',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      providerId,
      callbackURL,
      errorCallbackURL,
    }),
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #f37ba6ac071892ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/frontend/src/utils/fetchInterceptor.ts:87

    let response = await fetch(url, config);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #08ca38e626fd83ed — Environment-variable access.

repo/frontend/src/utils/interceptors.ts:92

  if (process.env.NODE_ENV === 'development') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #7937d03976f8aa62 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/frontend/src/utils/runtime.ts:70

        const response = await fetch(configPath, {
          method: 'GET',
          headers: {
            Accept: 'application/json',
            'Cache-Control': 'no-cache',
          },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs test-only Excluded from app score #fb114c6aef1d8724 — Filesystem access.

repo/frontend/vite.config.ts:6

import { readFileSync } from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #13a426da52c91c17 — Filesystem access.

repo/frontend/vite.config.ts:9

const packageJson = JSON.parse(readFileSync(path.resolve(__dirname, '../package.json'), 'utf-8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #708753a69efdadbc — Filesystem access.

repo/scripts/dev-backend.js:2

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #7d19ebcab3d4335d — Filesystem access.

repo/scripts/validate-release-notes.js:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #8f660ace243577c5 — Environment-variable access.

repo/scripts/validate-release-notes.js:26

    if (!value || !process.env[value]) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #b13c05de5b0c0cad — Environment-variable access.

repo/scripts/validate-release-notes.js:30

    return process.env[value];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #f3628bda6ade8704 — Filesystem access.

repo/scripts/validate-release-notes.js:37

  return fs.readFileSync(mode, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a95e840a3c2c123b — Filesystem access.

repo/scripts/verify-dist.js:2

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #892ed0d0615eed72 — Environment-variable access.

repo/src/betterAuth.ts:29

  process.env.GOOGLE_CLIENT_ID &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5e8bcac5bd715e09 — Environment-variable access.

repo/src/betterAuth.ts:30

  process.env.GOOGLE_CLIENT_SECRET

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8bb225b2dd774265 — Environment-variable access.

repo/src/betterAuth.ts:33

    clientId: process.env.GOOGLE_CLIENT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #211f60a691c0df9d — Environment-variable access.

repo/src/betterAuth.ts:34

    clientSecret: process.env.GOOGLE_CLIENT_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0b0ef1f8e7f2bc80 — Environment-variable access.

repo/src/betterAuth.ts:39

  process.env.GITHUB_CLIENT_ID &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #945a82edd90822d3 — Environment-variable access.

repo/src/betterAuth.ts:40

  process.env.GITHUB_CLIENT_SECRET

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #eb7400ed8cc9e067 — Environment-variable access.

repo/src/betterAuth.ts:43

    clientId: process.env.GITHUB_CLIENT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cf12c820c4935531 — Environment-variable access.

repo/src/betterAuth.ts:44

    clientSecret: process.env.GITHUB_CLIENT_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5710aa4accf3a59c — Environment-variable access.

repo/src/betterAuth.ts:50

  process.env.OIDC_CLIENT_ID &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2e5a6f3bd4e7f917 — Environment-variable access.

repo/src/betterAuth.ts:51

  process.env.OIDC_CLIENT_SECRET

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #123dd8dacfc6d5ab — Environment-variable access.

repo/src/betterAuth.ts:59

          clientId: process.env.OIDC_CLIENT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1202cc6e2f8d9aca — Environment-variable access.

repo/src/betterAuth.ts:60

          clientSecret: process.env.OIDC_CLIENT_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0597d89f5898c934 — Environment-variable access.

repo/src/betterAuth.ts:91

  process.env.BETTER_AUTH_URL ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bec56f344e142bcd — Environment-variable access.

repo/src/betterAuth.ts:97

const databaseUrl = process.env.DB_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1517445ef21bd1fa — Filesystem access.

repo/src/cli/call-arguments.ts:61

      content = reader.readFileSync(path, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #97a7b04cd9621be0 — Filesystem access.

repo/src/cli/commands/export.ts:19

    (deps.fs ?? fs).writeFileSync(outPath, json);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #e9b03d62ec807c8e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/cli/commands/groups.ts:114

  await client.post(`/api/groups/${encodeURIComponent(id)}/servers`, { serverName });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #91a7423cfc7688b8 — Filesystem access.

repo/src/cli/commands/install.ts:192

      existing = JSON.parse(reader.readFileSync(outPath, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #09d8ec7343054387 — Filesystem access.

repo/src/cli/commands/install.ts:212

  reader.writeFileSync(tmp, JSON.stringify(merged, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8da3bf8d67553afa — Filesystem access.

repo/src/cli/commands/servers.ts:97

    const raw = (deps.fs ?? fs).readFileSync(path, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #7ec1dfc44d158416 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/cli/commands/servers.ts:139

  await client.post(`/api/servers/${encodeURIComponent(name)}/toggle`, body);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #354886679fe47751 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/cli/commands/servers.ts:146

  await client.post(`/api/servers/${encodeURIComponent(name)}/reload`, {});

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #16432219048a879b — Environment-variable access.

repo/src/cli/context.ts:37

  const baseUrl = globals.url ?? process.env.MCPHUB_URL ?? profile?.url;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b26ae1628af2bb43 — Environment-variable access.

repo/src/cli/context.ts:45

    (process.env.MCPHUB_TOKEN_KIND as TokenKind | undefined) ??

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0b3abff39bd8ccf5 — Environment-variable access.

repo/src/cli/context.ts:48

  const token = globals.token ?? process.env.MCPHUB_TOKEN ?? profile?.token;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f315506a24630ef1 — Environment-variable access.

repo/src/cli/context.ts:64

  const baseUrl = remote ?? globals.url ?? process.env.MCPHUB_URL ?? profile?.url;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #32810b6fadddb8b9 — Environment-variable access.

repo/src/cli/output.ts:5

  process.env.NO_COLOR === undefined &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cd637acbd558539b — Environment-variable access.

repo/src/cli/output.ts:6

  process.env.TERM !== 'dumb' &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a19d1e6489e6ea51 — Environment-variable access.

repo/src/cli/profile.ts:33

  return process.env.HOME || process.env.USERPROFILE || os.homedir() || process.cwd();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #92110de4342a8c83 — Environment-variable access.

repo/src/cli/profile.ts:37

  return process.env.XDG_CONFIG_HOME || path.join(homeDir(), '.config');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #27041d9827ec7b29 — Environment-variable access.

repo/src/cli/profile.ts:41

  return process.env.XDG_DATA_HOME || path.join(homeDir(), '.local', 'share');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f4862dbf79b46840 — Filesystem access.

repo/src/cli/profile.ts:68

    const raw = fs.readFileSync(p, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7a284018f9cb41dc — Filesystem access.

repo/src/cli/profile.ts:91

  fs.writeFileSync(tmp, JSON.stringify(creds, null, 2), { mode: 0o600 });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #857ac61c9876c070 — Filesystem access.

repo/src/cli/profile.ts:104

    return JSON.parse(fs.readFileSync(p, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #18a61e7b279c4017 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/clients/openapi.ts:209

    const response = await this.httpClient.request({
      method: 'post',
      url: oauth2.tokenUrl,
      baseURL: undefined,
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
      },
      data: body.toString(),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #a2df8c7f5004e847 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/clients/openapi.ts:606

      const response = await this.httpClient.request(requestConfig);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #efc72de6adb09cec — Environment-variable access.

repo/src/config/configManager.ts:16

  port: process.env.PORT || 3000,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6bef38f2f01463ac — Environment-variable access.

repo/src/config/configManager.ts:17

  initTimeout: process.env.INIT_TIMEOUT || 300000,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #327cb1c9937f0534 — Environment-variable access.

repo/src/config/configManager.ts:18

  basePath: process.env.BASE_PATH || '',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f32faa6d5f03528 — Environment-variable access.

repo/src/config/configManager.ts:19

  readonly: 'true' === process.env.READONLY || false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4a5f68ad8b6bc559 — Environment-variable access.

repo/src/config/configManager.ts:25

const USE_DAO_LAYER = process.env.USE_DAO_LAYER === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2e43897725413cab — Environment-variable access.

repo/src/config/configManager.ts:92

  process.env.USE_DAO_LAYER = 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #10d99d57d52db88b — Environment-variable access.

repo/src/config/configManager.ts:99

  process.env.USE_DAO_LAYER = 'false';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f557e11afc9a4313 — Filesystem access.

repo/src/config/index.ts:2

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4a6cbf340d7ed490 — Environment-variable access.

repo/src/config/index.ts:14

  port: process.env.PORT || 3000,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1f90056613f5f1d5 — Environment-variable access.

repo/src/config/index.ts:15

  initTimeout: process.env.INIT_TIMEOUT || 300000,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #636645826dea5e65 — Environment-variable access.

repo/src/config/index.ts:16

  basePath: process.env.BASE_PATH || '',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #022c721b49750dc6 — Environment-variable access.

repo/src/config/index.ts:17

  readonly: 'true' === process.env.READONLY || false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bd4d530ebbf6fcc1 — Environment-variable access.

repo/src/config/index.ts:24

export const isWebDisabled = (): boolean => process.env.DISABLE_WEB === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #60c261d572d95489 — Filesystem access.

repo/src/config/index.ts:68

    const settingsData = fs.readFileSync(settingsPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9f2568ed967953cb — Filesystem access.

repo/src/config/index.ts:73

        fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0766bb25df8c0724 — Filesystem access.

repo/src/config/index.ts:100

    fs.writeFileSync(settingsPath, JSON.stringify(mergedSettings, null, 2), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fbbc41e37d0c76f9 — Environment-variable access.

repo/src/config/jwt.ts:3

let jwtSecret = process.env.JWT_SECRET;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4e857c79da8c596f — Environment-variable access.

repo/src/config/jwt.ts:6

  if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8e694501617c96d5 — Environment-variable access.

repo/src/controllers/healthController.ts:6

  return process.env.USE_DB !== undefined ? process.env.USE_DB === 'true' : !!process.env.DB_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6cfb5e791dca39c7 — Filesystem access.

repo/src/controllers/mcpbController.ts:4

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e6cdda9b3bee7d51 — Filesystem access.

repo/src/controllers/mcpbController.ts:128

      const manifestContent = fs.readFileSync(manifestPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #42d9303ce7c79aae — Hardcoded external endpoint. Review what data is sent to this destination.

repo/src/controllers/registryController.ts:16

    const url = new URL(`${REGISTRY_BASE_URL}/servers`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #0a9883529a6670dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/controllers/registryController.ts:30

    const response = await fetch(url.toString(), {
      headers: {
        Accept: 'application/json, application/problem+json',
      },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #571ac89ce43b3007 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/controllers/registryController.ts:76

    const response = await fetch(`${REGISTRY_BASE_URL}/servers/${encodedName}/versions`, {
      headers: {
        Accept: 'application/json, application/problem+json',
      },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #95747a4e48324ea8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/controllers/registryController.ts:131

    const response = await fetch(
      `${REGISTRY_BASE_URL}/servers/${encodedName}/versions/${encodedVersion}`,
      {
        headers: {
          Accept: 'application/json, application/problem+json',
        },
      },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #744e6058599661f4 — Environment-variable access.

repo/src/controllers/serverController.ts:322

    const dbUrlEnv = process.env.DB_URL || '';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7a270292facdb867 — Environment-variable access.

repo/src/controllers/serverController.ts:1713

            process.env.DB_URL || smartRouting.dbUrl || systemConfig.smartRouting.dbUrl;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #652b200e646ee28c — Environment-variable access.

repo/src/dao/DaoFactory.ts:174

    process.env.USE_DB !== undefined ? process.env.USE_DB === 'true' : !!process.env.DB_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fbb93101e71afe56 — Filesystem access.

repo/src/dao/base/JsonFileBaseDao.ts:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1c4b3d71304f2337 — Filesystem access.

repo/src/dao/base/JsonFileBaseDao.ts:27

      const settingsData = fs.readFileSync(settingsPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f32897449ccf039 — Filesystem access.

repo/src/dao/base/JsonFileBaseDao.ts:65

      fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #500041b3913515b3 — Environment-variable access.

repo/src/db/connection.ts:13

  poolSize: parseInt(process.env.DB_POOL_SIZE || '10', 10),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ee3f112fa4926916 — Environment-variable access.

repo/src/db/connection.ts:14

  poolIdleTimeout: parseInt(process.env.DB_POOL_IDLE_TIMEOUT || '30000', 10), // 30 seconds

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2e5642b0e4b41db9 — Environment-variable access.

repo/src/db/connection.ts:15

  connectionTimeout: parseInt(process.env.DB_CONNECTION_TIMEOUT || '60000', 10), // 60 seconds

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3920a240a7d1c7c6 — Environment-variable access.

repo/src/db/connection.ts:18

  maxConnectionRetries: parseInt(process.env.DB_MAX_CONNECTION_RETRIES || '5', 10),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f4d61ea1278cec54 — Environment-variable access.

repo/src/db/connection.ts:19

  connectionRetryDelayMs: parseInt(process.env.DB_CONNECTION_RETRY_DELAY || '3000', 10),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9d5dbc867641b9bd — Environment-variable access.

repo/src/db/connection.ts:22

  healthCheckIntervalMs: parseInt(process.env.DB_HEALTH_CHECK_INTERVAL || '30000', 10), // 30 seconds

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #84a080ba8dfb9b44 — Environment-variable access.

repo/src/db/connection.ts:23

  enableHealthCheck: process.env.DB_ENABLE_HEALTH_CHECK !== 'false',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a1ca99579142edf2 — Environment-variable access.

repo/src/index.ts:171

      process.env.USE_DB !== undefined ? process.env.USE_DB === 'true' : !!process.env.DB_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #40f990c699b0d173 — Environment-variable access.

repo/src/middlewares/auth.ts:14

  process.env.NODE_ENV === 'test' ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8914171a386f6c77 — Environment-variable access.

repo/src/middlewares/auth.ts:15

  process.env.JEST_WORKER_ID !== undefined ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #53c84e588846a41e — Environment-variable access.

repo/src/middlewares/auth.ts:16

  process.env.VITEST_WORKER_ID !== undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f3bb670c9065ebd5 — Environment-variable access.

repo/src/models/OAuth.ts:295

if (process.env.NODE_ENV !== 'test') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6174c0b0c04ef7b9 — Environment-variable access.

repo/src/models/User.ts:137

    const adminPasswordFromEnv = process.env.ADMIN_PASSWORD;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b2177810419029b9 — Environment-variable access.

repo/src/models/User.ts:143

    if (process.env.NODE_ENV === 'development') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f97dde1abb8e3c2a — Environment-variable access.

repo/src/routes/index.ts:180

    process.env.NODE_ENV === 'test' ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3973a4bedb1017d5 — Environment-variable access.

repo/src/routes/index.ts:181

    process.env.JEST_WORKER_ID !== undefined ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3541ed0001c73758 — Environment-variable access.

repo/src/routes/index.ts:182

    process.env.VITEST_WORKER_ID !== undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #924109516cd010b1 — Filesystem access.

repo/src/server.ts:5

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0a397ae4dac061db — Environment-variable access.

repo/src/server.ts:33

  if (process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID !== undefined) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ce1488a7d526009e — Environment-variable access.

repo/src/server.ts:249

      process.env.USE_DB !== undefined ? process.env.USE_DB === 'true' : !!process.env.DB_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ebd14023875e289f — Environment-variable access.

repo/src/server.ts:274

    const debug = process.env.DEBUG === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #af3912c40fb62acd — Environment-variable access.

repo/src/services/betterAuthConfig.ts:224

    resolveBooleanSetting(process.env.BETTER_AUTH_ENABLED, betterAuthSettings.enabled, true) &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c09a7207930c635c — Environment-variable access.

repo/src/services/betterAuthConfig.ts:227

    resolveStringSetting(process.env.BETTER_AUTH_BASE_PATH, betterAuthSettings.basePath),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8b6816e739d5364d — Environment-variable access.

repo/src/services/betterAuthConfig.ts:230

    process.env.BETTER_AUTH_TRUSTED_ORIGINS,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b5bfc067e164ffd0 — Environment-variable access.

repo/src/services/betterAuthConfig.ts:238

        process.env.BETTER_AUTH_URL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e065d533019cd37a — Environment-variable access.

repo/src/services/betterAuthConfig.ts:247

    process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6f38f5de1cd75564 — Environment-variable access.

repo/src/services/betterAuthConfig.ts:250

    process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cf059d25e40778ae — Environment-variable access.

repo/src/services/betterAuthConfig.ts:253

    process.env.OIDC_CLIENT_ID && process.env.OIDC_CLIENT_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5e7e287077886a9b — Environment-variable access.

repo/src/services/betterAuthConfig.ts:256

    process.env.BETTER_AUTH_OIDC_DISCOVERY_URL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #40a683cbbf50f1b7 — Environment-variable access.

repo/src/services/betterAuthConfig.ts:257

    resolveStringSetting(process.env.OIDC_DISCOVERY_URL, oidcSettings.discoveryUrl),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b7ab609f14003c84 — Environment-variable access.

repo/src/services/betterAuthConfig.ts:261

      process.env.BETTER_AUTH_OIDC_PROVIDER_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8e52dd8c3b55fedc — Environment-variable access.

repo/src/services/betterAuthConfig.ts:266

    process.env.BETTER_AUTH_OIDC_SCOPES,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5391b64a27fddaaf — Environment-variable access.

repo/src/services/betterAuthConfig.ts:270

  const oidcPkce = resolveBooleanSetting(process.env.BETTER_AUTH_OIDC_PKCE, oidcSettings.pkce, true);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2983bb9763c34fef — Environment-variable access.

repo/src/services/betterAuthConfig.ts:271

  const oidcPrompt = resolvePromptSetting(process.env.BETTER_AUTH_OIDC_PROMPT, oidcSettings.prompt);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1efba963bacf6a9a — Environment-variable access.

repo/src/services/betterAuthConfig.ts:273

    process.env.BETTER_AUTH_OIDC_TRUST_EMAIL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0580370716b5eb8b — Environment-variable access.

repo/src/services/betterAuthConfig.ts:278

    process.env.BETTER_AUTH_OIDC_ENABLED,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e3b62882cff36b8c — Environment-variable access.

repo/src/services/betterAuthConfig.ts:291

      process.env.BETTER_AUTH_GOOGLE_ENABLED,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bd577421d4ab84d7 — Environment-variable access.

repo/src/services/betterAuthConfig.ts:299

      process.env.BETTER_AUTH_GITHUB_ENABLED,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6258d972496551b9 — Environment-variable access.

repo/src/services/betterAuthConfig.ts:308

    process.env.BETTER_AUTH_DISABLE_AUTO_CREATE,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #61c774302e5ca7d3 — Environment-variable access.

repo/src/services/changelogService.ts:35

  if (process.env.DISABLE_UPDATE_CHECK === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #38134b1eada9c832 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/services/changelogService.ts:78

  const response = await fetch(url, {
    headers: { Accept: 'application/json' },
    signal: AbortSignal.timeout(timeoutMs()),
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #848429f12deaa55e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/services/changelogService.ts:98

  const response = await fetch(process.env.MCPHUB_NPM_LATEST_URL || DEFAULT_NPM_LATEST_URL, {
    headers: { Accept: 'application/json' },
    signal: AbortSignal.timeout(timeoutMs()),
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #80a99de979792c1d — Environment-variable access.

repo/src/services/changelogService.ts:98

  const response = await fetch(process.env.MCPHUB_NPM_LATEST_URL || DEFAULT_NPM_LATEST_URL, {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f8f91b51ade85177 — Environment-variable access.

repo/src/services/changelogService.ts:129

  return (process.env.MCPHUB_CHANGELOG_API_BASE || DEFAULT_CHANGELOG_API_BASE).replace(/\/+$/, '');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ad91da05f88e8945 — Environment-variable access.

repo/src/services/changelogService.ts:140

  const value = Number(process.env.MCPHUB_UPDATE_CHECK_TIMEOUT_MS);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c84bd4e154340142 — Environment-variable access.

repo/src/services/changelogService.ts:145

  const value = Number(process.env.MCPHUB_UPDATE_CHECK_CACHE_TTL_SECONDS);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aba84b142b4d12cf — Environment-variable access.

repo/src/services/cloudService.ts:21

    apiKey: mcpRouterConfig?.apiKey || process.env.MCPROUTER_API_KEY || '',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0f3388b8a94a493e — Environment-variable access.

repo/src/services/cloudService.ts:22

    referer: mcpRouterConfig?.referer || process.env.MCPROUTER_REFERER || 'https://www.mcphub.app',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e674409bc227ef6f — Environment-variable access.

repo/src/services/cloudService.ts:23

    title: mcpRouterConfig?.title || process.env.MCPROUTER_TITLE || 'MCPHub',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #57fbc16f900c1e6f — Environment-variable access.

repo/src/services/cloudService.ts:25

      mcpRouterConfig?.baseUrl || process.env.MCPROUTER_API_BASE || DEFAULT_MCPROUTER_API_BASE,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0093f56aaac9d995 — Environment-variable access.

repo/src/services/hostedControlPlaneClient.ts:91

  const raw = process.env.HOSTED_CONTROL_PLANE_URL || process.env.MCPHUB_APP_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #e7c607abdc548180 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/services/hostedControlPlaneClient.ts:156

  const response = await fetch(`${controlPlaneBaseUrl()}${path}`, {
    method,
    headers: {
      ...authHeaders,
      ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
    },
    body: body === undefined ? undefined : bodyText,
    signal: AbortSignal.timeout(Number(process.env.HOSTED_CONTROL_PLANE_TIMEOUT_MS || 5000)),
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #a144cb0adde46256 — Environment-variable access.

repo/src/services/hostedControlPlaneClient.ts:163

    signal: AbortSignal.timeout(Number(process.env.HOSTED_CONTROL_PLANE_TIMEOUT_MS || 5000)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #8450b979f461dab3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/services/hostedControlPlaneClient.ts:174

  const response = await fetch(`${controlPlaneBaseUrl()}${VALIDATE_API_KEY_PATH}`, {
    method: VALIDATE_API_KEY_METHOD,
    headers: {
      ...createValidateHostedApiKeyAuthHeaders(),
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(body),
    signal: AbortSignal.timeout(Number(process.env.HOSTED_CONTROL_PLANE_TIMEOUT_MS || 5000)),
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #69c19c4977fbfda0 — Environment-variable access.

repo/src/services/hostedControlPlaneClient.ts:181

    signal: AbortSignal.timeout(Number(process.env.HOSTED_CONTROL_PLANE_TIMEOUT_MS || 5000)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ff854ec7112f968f — Environment-variable access.

repo/src/services/hostedEventSubscriber.ts:29

  return process.env.HUB_EVENT_CHANNEL || DEFAULT_EVENT_CHANNEL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #21261f63ad2992d4 — Environment-variable access.

repo/src/services/hostedEventSubscriber.ts:33

  return process.env.HUB_EVENT_REDIS_URL || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a15fb0602f9a0225 — Environment-variable access.

repo/src/services/hostedEventSubscriber.ts:38

  if ((process.env.HUB_EVENT_TRANSPORT || '').toLowerCase() === 'webhook') return false;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3860ec427f7bac4c — Environment-variable access.

repo/src/services/hostedInternalAuth.ts:67

  const secret = process.env.INTERNAL_API_SECRET;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d6b3cf6dc08781c3 — Environment-variable access.

repo/src/services/hostedMode.ts:2

  return process.env.HUB_MODE === 'hosted';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #19d28aaed8a72970 — Environment-variable access.

repo/src/services/hostedNodeIdentity.ts:10

    clusterId: process.env.HUB_CLUSTER_ID || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c4e2fc4a4ce07ee6 — Environment-variable access.

repo/src/services/hostedNodeIdentity.ts:11

    nodeId: process.env.HUB_NODE_ID || os.hostname(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #daf2b4c20236db02 — Filesystem access.

repo/src/services/marketService.ts:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2daf436dbd81e7be — Filesystem access.

repo/src/services/marketService.ts:14

    const data = fs.readFileSync(serversJsonPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0572e5d447b2dfe3 — Filesystem access.

repo/src/services/mcpService.ts:3

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #00f57f0e41a1de60 — Environment-variable access.

repo/src/services/mcpService.ts:117

  const pathEnv = process.env.PATH || '';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0824c9eb154f59de — Filesystem access.

repo/src/services/mcpService.ts:184

  fs.writeFileSync(configPath, configContent, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #daac80d8688ca844 — Environment-variable access.

repo/src/services/mcpService.ts:1277

    env['PATH'] = expandEnvVars(process.env.PATH as string) || '';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9afbcea2c85493cb — Environment-variable access.

repo/src/services/mcpService.ts:1667

      const defaultRequestTimeout = Number(process.env.DEFAULT_REQUEST_TIMEOUT) || 60000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #9c100ec20e086d00 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/services/oauthClientRegistration.ts:77

    const response = await fetch(resourceMetadataUrl, {
      method: 'GET',
      headers: {
        Accept: 'application/json',
      },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #423e7d55158e0a04 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/services/oauthService.ts:46

          const response = await fetch(oauthConfig.verifyAccessToken.endpoint, {
            method: 'POST',
            headers: {
              'Content-Type': 'application/json',
              ...oauthConfig.verifyAccessToken.headers,
            },
            body: JSON.stringify({ token }),
          });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #5c094e248f93ac25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/services/vectorSearchService.ts:99

  const response = await axios.post(
    url,
    {
      input: text,
    },
    {
      headers: {
        'api-key': azureConfig.apiKey,
        'Content-Type': 'application/json',
      },
    },
  );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #51d61a498605ca12 — Environment-variable access.

repo/src/services/vectorSearchService.ts:781

  if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #20f1b222ab940aca — Environment-variable access.

repo/src/services/vectorSearchService.ts:1539

    if (!smartRoutingConfig.dbUrl && !process.env.DB_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fb8901f4c80c172b — Filesystem access.

repo/src/utils/cacheUtils.ts:3

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #72f88c19656bcc70 — Environment-variable access.

repo/src/utils/cacheUtils.ts:20

    return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'npm-cache', '_npx');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f0b0cae82b205e97 — Filesystem access.

repo/src/utils/i18n.ts:4

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #39ebe01647278881 — Filesystem access.

repo/src/utils/path.ts:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #825db131854d5c07 — Environment-variable access.

repo/src/utils/path.ts:18

  if (process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID !== undefined) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9041e649856de935 — Filesystem access.

repo/src/utils/path.ts:37

          const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a858a5f2854ca699 — Environment-variable access.

repo/src/utils/path.ts:68

  const debug = process.env.DEBUG === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #17f6b777a024c27b — Filesystem access.

repo/src/utils/path.ts:139

        const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cfcb73be9484996f — Environment-variable access.

repo/src/utils/path.ts:206

    const envPath = process.env.MCPHUB_SETTING_PATH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #894804a37f817b76 — Filesystem access.

repo/src/utils/proxyTrust.ts:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ab098df26e546dca — Environment-variable access.

repo/src/utils/rateLimit.ts:4

  process.env.NODE_ENV === 'test' ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #23d00bd237f61050 — Environment-variable access.

repo/src/utils/rateLimit.ts:5

  process.env.JEST_WORKER_ID !== undefined ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e5e4d90ef2f845d8 — Environment-variable access.

repo/src/utils/rateLimit.ts:6

  process.env.VITEST_WORKER_ID !== undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cbc91335d9d4b5c4 — Environment-variable access.

repo/src/utils/smartRouting.ts:76

      [process.env.SMART_ROUTING_ENABLED],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f5e148793b64feb — Environment-variable access.

repo/src/utils/smartRouting.ts:83

    dbUrl: getConfigValue([process.env.DB_URL], smartRoutingSettings.dbUrl, '', expandEnvVars),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e0b329e882e65f12 — Environment-variable access.

repo/src/utils/smartRouting.ts:86

      [process.env.SMART_ROUTING_BASE_PACING_DELAY_MS],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a58c3d62cc048fd0 — Environment-variable access.

repo/src/utils/smartRouting.ts:96

      [process.env.SMART_ROUTING_EMBEDDING_PROVIDER],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2f9d2cd4efce0067 — Environment-variable access.

repo/src/utils/smartRouting.ts:111

      [process.env.SMART_ROUTING_EMBEDDING_ENCODING_FORMAT],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5f6c739f64e25356 — Environment-variable access.

repo/src/utils/smartRouting.ts:127

      [process.env.OPENAI_API_BASE_URL],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bbc2713374f5d034 — Environment-variable access.

repo/src/utils/smartRouting.ts:134

      [process.env.OPENAI_API_KEY],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f6672d3ccc06fe8 — Environment-variable access.

repo/src/utils/smartRouting.ts:141

      [process.env.EMBEDDING_MODEL],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #46948d28bec08f63 — Environment-variable access.

repo/src/utils/smartRouting.ts:148

      [process.env.AZURE_OPENAI_ENDPOINT],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d0d5f62bd7900530 — Environment-variable access.

repo/src/utils/smartRouting.ts:155

      [process.env.AZURE_OPENAI_API_KEY],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #283f14405a948b29 — Environment-variable access.

repo/src/utils/smartRouting.ts:162

      [process.env.AZURE_OPENAI_API_VERSION],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f59d3f5a7d6bda22 — Environment-variable access.

repo/src/utils/smartRouting.ts:169

      [process.env.AZURE_OPENAI_EMBEDDING_DEPLOYMENT],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0f7fe1a038bb9c84 — Environment-variable access.

repo/src/utils/smartRouting.ts:176

      [process.env.AZURE_OPENAI_EMBEDDING_MODEL],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5069ba57d145b685 — Environment-variable access.

repo/src/utils/smartRouting.ts:185

      [process.env.SMART_ROUTING_PROGRESSIVE_DISCLOSURE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #88d240bc97e3d8fe — Environment-variable access.

repo/src/utils/smartRouting.ts:192

      [process.env.SMART_ROUTING_SERVER_DESCRIPTION_MODE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #19325b2af346f4ef — Environment-variable access.

repo/src/utils/smartRouting.ts:206

      [process.env.EMBEDDING_MAX_TOKENS],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #690bf62be5e1bb5e — Environment-variable access.

repo/src/utils/systemConfigCache.ts:6

  process.env.USE_DB !== undefined ? process.env.USE_DB === 'true' : Boolean(process.env.DB_URL);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #5ec42a5ae5cc1c26 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/src/utils/tokenTruncation.ts:178

  const response = await fetch(url, {
    signal: AbortSignal.timeout(HF_FETCH_TIMEOUT_MS),
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #16ff42ed91027233 — Hardcoded external endpoint. Review what data is sent to this destination.

repo/src/utils/tokenTruncation.ts:310

    const health = hostHealth.get(HF_OFFICIAL_HOST)!;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #66e2e51bb67b0b42 — Filesystem access.

repo/src/utils/version.ts:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c50f4ff4ad408a81 — Filesystem access.

repo/src/utils/version.ts:22

    const packageJsonContent = fs.readFileSync(packageJsonPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

hono

npm dependency

high pii_flow tooling Excluded from app score unknown #fd29fb5f70a38766 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

pkgs/npm/[email protected]__reposrc/runtime-tests/node/index.test.ts:236 · flow /tmp/closeopen-imo_y475/pkgs/npm/[email protected]__reposrc/runtime-tests/node/index.test.ts:236 → /tmp/closeopen-imo_y475/pkgs/npm/[email protected]__reposrc/runtime-tests/node/index.test.ts:236

    return fetch(`http://${serverInfo.address}:${serverInfo.port}/${c.req.param('file')}`)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

expand_more 58 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #7dff37035911bec4 — Filesystem access.

pkgs/npm/[email protected]__reposrc/benchmarks/http-server/benchmark.ts:90

  writeFileSync(join(TEMP_DIR, 'body.json'), '{"hello":"world"}')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #396ef06497489e8b — Filesystem access.

pkgs/npm/[email protected]__reposrc/benchmarks/http-server/benchmark.ts:125

  writeFileSync(appPath, getAppTemplate())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #cca6d7add3acd0db — Filesystem access.

pkgs/npm/[email protected]__reposrc/benchmarks/http-server/benchmark.ts:315

    writeFileSync(join(SCRIPT_DIR, 'benchmark-results.md'), markdownOutput)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5a49039133aed8c7 — Filesystem access.

pkgs/npm/[email protected]__reposrc/perf-measures/type-check/scripts/generate-app.ts:22

writeFile(path.join(import.meta.dirname, '../generated/app.ts'), routes, (err) => {
  if (err) {
    throw err
  }
  console.log(`${count} routes have been written to app.ts`)
})

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #fb76cc1dffc041c9 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/perf-measures/type-check/scripts/process-results.ts:9

  const tsImplLabel = process.env['BENCHMARK_TS_IMPL_LABEL']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #13b57a50c46c30ed — Filesystem access.

pkgs/npm/[email protected]__reposrc/runtime-tests/bun/index.test.tsx:2

import fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #16bd411eda83a9a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/bun/index.test.tsx:406

      const res = fetch(req).catch(() => {})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #75ec9866f568f46a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/bun/index.test.tsx:418

      const res = await fetch(`http://localhost:${server.port}/streamHello`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #75fac7312f4cad69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/bun/index.test.tsx:430

      const res = fetch(req).catch(() => {})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #b06cc776315c995c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/bun/index.test.tsx:442

      const res = await fetch(`http://localhost:${server.port}/streamSSEHello`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #116ded4bcc6ede19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/deno/stream.test.ts:26

  const res = fetch(req).catch(() => {})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #cd5fc1e203fc0d99 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/deno/stream.test.ts:55

  const res = await fetch(`http://localhost:${server.addr.port}/stream`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #fdd2dddaf123d51c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/deno/stream.test.ts:82

  const res = fetch(req).catch(() => {})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #33ec437dffbb0635 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/deno/stream.test.ts:111

  const res = await fetch(`http://localhost:${server.addr.port}/stream`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #2624b430dd5b6420 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/runtime-tests/node/index.test.ts:236

    return fetch(`http://${serverInfo.address}:${serverInfo.port}/${c.req.param('file')}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #88539950580a93f2 — Filesystem access.

pkgs/npm/[email protected]__reposrc/src/adapter/deno/ssg.ts:13

    await Deno.writeFile(path, uint8Data)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #410ed929ad76659c — Filesystem access.

pkgs/npm/[email protected]__reposrc/src/helper/ssg/ssg.ts:329

    await fsModule.writeFile(filePath, content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbb146357f191c08 — Filesystem access.

pkgs/npm/[email protected]__reposrc/src/helper/ssg/ssg.ts:331

    await fsModule.writeFile(filePath, new Uint8Array(content))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #d25136d2f07c4678 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:647

    let res = await app.request('http://www1.example.com/hello')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f2b1c56d6b295ff6 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:652

    res = await app.request('http://www2.example.com/hello')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #a48176c5c6168bca — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:657

    res = await app.request('http://www1.example.com/')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #2adb74a4dc3cc6d9 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:662

    res = await app.request('http://www1.example.com/sub')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #61446cd46a4b1bc1 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:667

    res = await app.request('http://www1.example.com/sub/foo')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #0fae3660a972617c — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:689

    let res = await app.request('http://www1.example.com/hello', {
      headers: {
        host: 'www1.example.com',
      },
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #d666da718d69b1f0 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:698

    res = await app.request('http://www2.example.com/hello', {
      headers: {
        host: 'www2.example.com',
      },
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #2fe03c9ec2fc2205 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:707

    res = await app.request('http://www1.example.com/', {
      headers: {
        host: 'www1.example.com',
      },
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #ce200a522094266c — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:716

    res = await app.request('http://www1.example.com/sub', {
      headers: {
        host: 'www1.example.com',
      },
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #227d9ee1c4b15b96 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:725

    res = await app.request('http://www1.example.com/sub/foo', {
      headers: {
        host: 'www1.example.com',
      },
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #97a6b2bb2e621d62 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1402

    const res = await app.request('https://example.com/redirect')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f818a4eadbf2275b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1434

      let res = await app.request('https://example.com/error')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #b2b131232d8e1636 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1439

      res = await app.request('https://example.com/error-middleware')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #1917ad1a9540f4e7 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1469

      let res = await app.request('https://example.com/error')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #0aa94d59035c9d46 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1474

      res = await app.request('https://example.com/error-middleware')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #b52a8815be6c004e — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1589

    const res = await app.request('https://example.com/handle-error-in-middleware')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #66ef5489a2de32c6 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1597

    const res = await app.request('https://example.com/handle-error-in-middleware-async')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #3df5cee0bdbacdd5 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1909

      const res = await app.request('https://example.com/sub/posts/123')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #1f4f89323d73d8ce — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1916

      const res = await app.request('https://example.com/sub/ok?app-error=1')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #454caf29bda24887 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1922

      const res = await app.request('https://example.com/sub/error')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #fe2d2bfa4cf0319b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1945

      const res = await app.request('https://example.com/sub/ok')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f9fb2ec34be5c87b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1950

      const res = await app.request('https://example.com/sub/error')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #e7b572872beda0e9 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1983

      const res = await app.request('https://example.com/explicit-404')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #d81df9275363c4b9 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1990

      const res = await app.request('https://example.com/sub/explicit-404')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #608b9ff25e776ce2 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:1997

      const res = await app.request('https://example.com/implicit-404')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f870827df366187b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/hono.test.ts:2004

      const res = await app.request('https://example.com/sub/implicit-404')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #7cdb3a1895bfa6cf — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:234

        const res = await app.request(
          'https://example.com/form',
          buildSimplePostRequestData({ origin: 'https://example.com' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #3befb86ae1513b5a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:242

        const res = await app.request(
          'https://example.jp/form',
          buildSimplePostRequestData({ origin: 'https://example.jp' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #bb89f7f72b997c62 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:263

        let res = await app.request(
          'https://hono.example.com/form',
          buildSimplePostRequestData({ origin: 'https://hono.example.com' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f4c9c6d4f5d23857 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:269

        res = await app.request(
          'https://example.com/form',
          buildSimplePostRequestData({ origin: 'https://example.com' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #659fae1e09059547 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:277

        const res = await app.request(
          'http://example.jp/form',
          buildSimplePostRequestData({ origin: 'http://example.jp' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #61299f67d7038f85 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:298

        let res = await app.request(
          'https://hono.example.com/form',
          buildSimplePostRequestData({ origin: 'https://hono.example.com' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #7cf29ac78f3de7d4 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:304

        res = await app.request(
          'https://example.com/form',
          buildSimplePostRequestData({ origin: 'https://example.com' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #125b797431f168f0 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:312

        let res = await app.request(
          'http://honojs.hono.example.jp/form',
          buildSimplePostRequestData({ origin: 'http://example.jp' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #cb337ff1074b3c9d — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:319

        res = await app.request(
          'http://example.jp/form',
          buildSimplePostRequestData({ origin: 'http://example.jp' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #681c54035b0cd95a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:343

        let res = await app.request(
          'https://hono.example.com/form',
          buildSimplePostRequestData({ origin: 'https://hono.example.com' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #5689f35300c55eec — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:349

        res = await app.request(
          'https://example.com/form',
          buildSimplePostRequestData({ origin: 'https://example.com' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #3fcc03a92d6a1ef3 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:357

        let res = await app.request(
          'http://honojs.hono.example.jp/form',
          buildSimplePostRequestData({ origin: 'http://example.jp' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #faab49cb4c53924a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/middleware/csrf/index.test.ts:364

        res = await app.request(
          'http://example.jp/form',
          buildSimplePostRequestData({ origin: 'http://example.jp' })
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #094ea00609ba6e9e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/src/utils/jwt/jwt.ts:231

    const response = await fetch(options.jwks_uri, init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@google/genai

npm dependency

medium pii_flow dependency Excluded from app score #686f93c578447b83 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:27 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:27

    console.debug(text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7ffae08c29f21208 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:19 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:19

  console.log('text response: ', response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #bd626dea90ba0fa0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:19 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:19

  console.log('text response: ', response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d961a13e8d77aa8e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:83 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:83

    console.log(`Uploaded file as: ${uploadedFile.name}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6507b59dbaff39ac — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:103 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:103

  console.log(`Creating batch embedding job with file: ${inputFile}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #bdbbf372f6660d70 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:109 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:109

  console.log(`Created batch job: ${batchJob.name}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c9e42f36a3c3024d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:117 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:117

  console.log('result: ', result);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #77e0fc2dfb50c97c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:124 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:124

    console.log(
      `Batch job not done yet, current state: ${
        result.state
      }. Waiting 60 seconds...`,
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #51332218ad656145 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:133 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:133

  console.log(`Batch job finished with state: ${result.state}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #fbf0e3c6e38d6345 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:161 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:161

    console.error('Batch job failed:', result.error);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #a06ab087b16b8ce2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:163 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:163

    console.warn(`Batch job finished with unexpected state: ${result.state}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8c8c8c70a3ebabbb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:52 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:52

  console.log(`Created batch job: ${batchJob.name}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #24ff6c914c9fe4c4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:66 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:66

    console.log(
      `Batch job not done yet, current state: ${
        result.state
      }. Waiting 10 seconds...`,
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6cfc6b870e919a04 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:76 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:76

  console.log(`Batch job finished with state: ${result.state}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #331601262960868f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:80 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:80

    console.log(result.dest?.inlinedEmbedContentResponses);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8b0ec0f50440d483 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:82 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:82

    console.error('Batch job failed:', result.error);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4b68ce57d09fd7ed — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:84 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:84

    console.warn(`Batch job finished with state: ${result.state}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #92746f2315b8907e — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:307 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:296 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:307

          headers: {
            'x-goog-api-key': apiKey,
            'content-type': 'application/json',
          },

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium pii_flow dependency Excluded from app score #c80a9077ea682d80 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:76 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:15 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:76

      console.log(chunk.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #95f80fb0abb69b08 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:84 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:15 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:84

      console.log(chunk.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #721009902440cd7a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:87 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:15 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:87

  console.log('History: ', JSON.stringify(chat.getHistory(), null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #45edb7f0387261bf — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:19 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:19

  console.debug('chat response 1: ', response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2d93293a736667c0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:21 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:21

  console.debug('chat response 2: ', response2.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #277720d7f191ab62 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:25 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:25

    console.debug('chat history: ', JSON.stringify(content, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7db18af900226d70 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:36 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:36

    console.debug('chat response 1 chunk: ', chunk.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3d2b8b1b90377b0c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:42 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:42

    console.debug('chat response 2 chunk: ', chunk.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #29d6c869ebbe849f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:46 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:46

    console.debug('chat history: ', JSON.stringify(content, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #106ee2c0b202267c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:21 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:21

  console.debug(JSON.stringify(response));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #9e0c82e4c6815242 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/direct_url.ts:23 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/direct_url.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/direct_url.ts:23

  console.log(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f8d991ee1c526ea3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:21 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:21

  console.debug(JSON.stringify(response));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #9c3e7992d80fa149 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:25 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:25

    console.log('list file search store: ', fileSearchStore);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #87fa029932582981 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:34 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:34

  console.log('get file search store: ', fileSearchStore);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0fd5581ea6546e67 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:40 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:40

  console.log('create file search store: ', fileSearchStore);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3b51ccd9ff86b289 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:47 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:47

  console.log('uploaded file: ', file.name);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0fef9df9f3ced15f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:59 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:59

    console.log('operation: ', op);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2260c9cbee1c9a7d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:76 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:76

    console.log('operation: ', op);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8176241cb9f98688 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:96 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:96

  console.log('text response: ', response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5704b710dfd9849d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:97 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:97

  console.log(
    'grounding metadata: ',
    JSON.stringify(response.candidates?.[0]?.groundingMetadata, null, 2),
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e64ca6b0db8f87fb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:118 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:118

    console.log('list documents: ', document);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4f5744512378f2f1 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:131 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:131

  console.log('get document: ', document);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3f072778077b740c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:80 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:16 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:80

      console.log(chunk.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5ced35afb9dea7bc — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:31 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:9 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:31

      console.debug(text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #12e44421f2a54681 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:25 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:25

  console.debug(response.executableCode);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8622bd2a8e134a27 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:26 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:26

  console.debug(response.codeExecutionResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #14554cd777530d7b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:32 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:32

    console.log(`current file status: ${getFile.state}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b91f0f7fa76e2cd7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:58 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:58

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #40326c7b26dc37b4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:55 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:13 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:55

  console.debug(response.functionCalls);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #868dcc2f257b1334 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:52 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:10 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:52

  console.debug(response.functionCalls);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2217bd8093d87d97 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:29 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:29

  console.debug(response!.candidates![0]!.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #743444d89b50225f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:24 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:24

  console.debug(JSON.stringify(response));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6371d35c7e3d5852 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:27 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:27

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8fa24c742a3e2c5f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:38 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:38

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #516b9cc5d08ac18b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:42 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:9 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:42

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #60653a783538bd07 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:36 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:13 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:36

  console.debug(JSON.stringify(response?.candidates?.[0]?.safetyRatings));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #12cee7f3474283eb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:23 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:23

  console.debug(JSON.stringify(response?.candidates?.[0]?.groundingMetadata));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f9febf9d8aa944f5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:20 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:20

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #aadcec1b11baf0a2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:19 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:19

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c5df471bf4c0db1d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text_vertex_apikey.ts:20 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text_vertex_apikey.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text_vertex_apikey.ts:20

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #72039bdd08ae6492 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:24 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:24

  console.debug(response.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #042a22dde8794925 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:26 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:26

    console.debug(response.candidates[0].urlContextMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #16379ff973582ebd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:24 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:24

  console.debug(response?.generatedImages?.[0]?.image?.imageBytes);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #542efa8f94013266 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:36 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:36

    console.log(
      `No videos generated due to: ${JSON.stringify(
        operation.response?.raiMediaFilteredReasons,
        null,
        2,
      )}`,
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #44e2823ba8a76c77 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_basic.ts:19 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_basic.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_basic.ts:19

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #a966900d6da22080 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:70 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:70

      console.log(
        `Function call: ${step.name} with arguments ${JSON.stringify(
          step.arguments,
        )}`,
      );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f6fa0462f7bfce19 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:92 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:92

      console.log(`Final response: ${response2}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #dbe1687fb0fb019c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:94 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:94

      console.log(`Output: ${step}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4a6a198603242523 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:56 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:56

      console.log(
        `Function call: ${step.name} with arguments ${JSON.stringify(
          step.arguments,
        )}`,
      );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0f50427604c0aba5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:79 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:79

      console.log(`Final response: ${response2}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7cfef1b1d46a7ffb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:81 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:81

      console.log(`Output: ${step}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #885d3822093c6350 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:19 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:19

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #071bc4fd77cb6ecf — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:22 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:22

  console.debug(getResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cb75a43dfe3007b2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:38 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:38

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6da3b86c8e043d19 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:42 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:42

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8e6c95a60a3b8dc9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:66 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:66

  console.debug(generateContentResponse.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d098d69867d88157 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:38 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:38

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8c86e9476abd7c0d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:41 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:41

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #fc72c46ee1b80c45 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:64 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:64

  console.debug(generateContentResponse.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #fe8aa0f92e0bebb8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:55 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:55

  console.debug(
    'Generate Content response text: ',
    generateContentResponse.text,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5252d695e968581d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:59 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:59

  console.debug(
    'Generate Content response data: ',
    generateContentResponse.data,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #351daf03707f2835 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:52 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:52

  console.debug(
    'Generate Content response text: ',
    generateContentResponse.text,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0210b68993ef6807 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:56 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:56

  console.debug(
    'Generate Content response data: ',
    generateContentResponse.data,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6d4be49a39afa412 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:22 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:22

  console.log('Model: ', response1);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #584740ff187eb338 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:31 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:31

  console.log('Model: ', response2);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #91c334176e748a06 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:34 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:34

  console.log('Model: ', response1);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #78cca4ed7f20d5ef — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:54 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:54

  console.log('Model: ', response2);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d55f307406453612 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_structured_output_json.ts:22 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_structured_output_json.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_structured_output_json.ts:22

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #efcf2324437ca98b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_code_execution.ts:21 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_code_execution.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_code_execution.ts:21

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #19ba9da6170488ed — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_computer_use.ts:22 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_computer_use.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_computer_use.ts:22

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #27c2274f3f5cb662 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_functions.ts:52 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_functions.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_functions.ts:52

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #235fc597de794024 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_google_search.ts:21 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_google_search.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_google_search.ts:21

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d2df673b93ef1bbc — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mcp_server.ts:29 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mcp_server.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mcp_server.ts:29

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c93e565368bc766d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mime_type.ts:49 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mime_type.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mime_type.ts:49

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #bf67cfac14c8def7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_url_context.ts:22 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_url_context.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_url_context.ts:22

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e7c70faa0148c44b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_with_config.ts:21 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_with_config.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_with_config.ts:21

  console.debug(response);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cff6e2857973834e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:184 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:13 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:184

    console.log('Token:', JSON.stringify(token));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #317270666fdb68f4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_ephemeral.ts:152 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/live_ephemeral.ts:13 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/live_ephemeral.ts:152

  console.log('Token:', JSON.stringify(token));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8d14fd6c64c353b5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:37 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:9 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:37

  console.log('Registered file: ', file);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #87a88cff06d25c28 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:45 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:9 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:45

  console.log(result.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #443e751fd3d53a2f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:41 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:41

  console.log(`Trigger created successfully! ID: ${triggerId}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #213976756b22e5e8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:44 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:44

  console.log('Getting trigger by ID:', triggerId);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #197b81bf20b7fbf2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:46 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:46

  console.log('Got trigger:', fetchedTrigger);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #fbd8479a3182f1e1 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:52 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:52

    console.log('Trigger:', trigger);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7d59a92bf632a078 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:61 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:61

  console.log('Paused trigger status:', pausedTrigger.status);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #ff544788787752b9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:69 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:69

  console.log('Resumed trigger status:', resumedTrigger.status);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c98701567c29cbdd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:76 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:76

  console.log('Trigger execution details:', executionResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c82b074dde0b621e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:80 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:80

  console.log('Listing executions for trigger:', triggerId);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2d8de3407348305e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:85 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:85

  console.log('Trigger executions:', executions);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2de5ed846291d315 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:89 · flow /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8 → /tmp/closeopen-imo_y475/pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:89

  console.log('Deleting trigger:', triggerId);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 368 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #e568b00483a306a7 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/rollup.config.mjs:2

import {readFileSync} from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9c7ad7520b548cf7 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/rollup.config.mjs:6

  readFileSync(new URL('./package.json', import.meta.url), 'utf8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #e175dda1bcbba021 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/add_docsite_license_headers.ts:7

import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #83942e5b659f787d — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/add_docsite_license_headers.ts:20

  const content = fs.readFileSync(filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #034f0ec488a38877 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/add_docsite_license_headers.ts:24

  fs.writeFileSync(filePath, header + content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #0d7a0a73588ea3a0 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/generate_pages.ts:8

import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #2f71a8f9b57dcdde — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/generate_pages.ts:39

  const content = fs.readFileSync(filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9a918263042a57ed — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/generate_pages.ts:43

  fs.writeFileSync(filePath, HEADER + content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9dc7f23079db4cb9 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/generate_pages.ts:87

    const manifestContent = fs.readFileSync(manifestPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #886646062ab9c47f — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/ignore_missing_mcp_dep.js:7

import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #97a53586569983b1 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/ignore_missing_mcp_dep.js:64

    const fileContent = fs.readFileSync(absolutePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #d3bbb65fee8d4090 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/ignore_missing_mcp_dep.js:74

      fs.writeFileSync(absolutePath, newContent, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #d3b9531c40892d45 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/scripts/prepare.js:22

const isCI = process.env.CI === 'true' || process.env.KOKORO_JOB_TYPE !== undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eba89e0c0f96cc73 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53cca41bf44104d8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2a68890561861b8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa6d3dcaa9439cdf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/abort_signal.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1aa93a0921b4111a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2cd282b3acfa66ec — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a200422e897e4ea — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52ee97266c3dcbcf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_error.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #844001941a3b1c19 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a45ad390ad128853 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48c2bae4d32ab17e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0da1b31cf3cd1ae2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/api_version.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bca0ed8221ddb5e7 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:10

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf1a8c2fb799add4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:17

  apiKey: process.env.GEMINI_API_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fd72cbeef50a755 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:28

  if (process.env.GOOGLE_GENAI_USE_VERTEXAI) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10c76e94c5cb92f0 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:71

    await fs.writeFile(tempFilePath, jsonlContent);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c495a325707303e — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_file.ts:148

      const contentString = await fs.readFile(tempFilePath, {encoding: 'utf8'});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8cdf175e1cc4c73b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:14

  apiKey: process.env.GEMINI_API_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fb701c9010e1157 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/batch_embedding_inline.ts:25

  if (process.env.GOOGLE_GENAI_USE_VERTEXAI) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f380604b91b8ebe — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:18

const SKIP_HTTP = process.env.SKIP_HTTP === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #084dc724b5c9c183 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:26

const MODE = (process.env.MODE || 'live') as 'live' | 'record' | 'mock';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #309988d4563e6c61 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:35

  const mockedData = fs.readFileSync(MOCK_FILE);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aae43bb5923d721e — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:92

                fs.writeFileSync(MOCK_FILE, Buffer.concat(buffers));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14765eb4c848ee52 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:296

          process.env.GCLOUD_API_KEY ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6b01e41bc74c676 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:297

          process.env.GOOGLE_API_KEY ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43b65e97417a8654 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:298

          process.env.GEMINI_API_KEY ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #06d727d36b87b86a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:300

        const url = new URL(
          'https://generativelanguage.googleapis.com/v1beta/interactions',
        );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #305b72b1d74e78eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:305

        const response = await fetch(url, {
          method: 'POST',
          headers: {
            'x-goog-api-key': apiKey,
            'content-type': 'application/json',
          },
          body: JSON.stringify(requestBody),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #68da1451a9882a46 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:380

  delete process.env.GOOGLE_GEMINI_BASE_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05af0ee15dd9827c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:382

    process.env.GCLOUD_API_KEY ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c43f5eaf94ad4942 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:383

    process.env.GOOGLE_API_KEY ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e52abce0bf07464 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/benchmark_streaming.ts:384

    process.env.GEMINI_API_KEY ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26b4fd6610f180b0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/caches.ts:8

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac4b2bbcf8dfb9de — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/caches.ts:9

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bad5a7c683e0311 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/caches.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdfe76c9be085e68 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc.ts:12

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1df99682c320a9b5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc.ts:13

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #893bd1d969c02eb1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc.ts:14

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4195372cbb501ae — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc.ts:15

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #595f671d02e63d49 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:15

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e5348e998326c30 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:16

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76f5be4cdf452226 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:17

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d6ca3c79b4646be — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming.ts:18

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7899e1f230b53b8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming_function_call.ts:15

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a64c225b220d9fa2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming_function_call.ts:16

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac146e93ec55dc55 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chat_afc_streaming_function_call.ts:17

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c4fc9febbe7f3c3 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e619022518744428 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d6cc1f6f7dbb23e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #332c7af957502a79 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/chats.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39c643e18780d62a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d1ce2f8191ab41f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8da0ad3180ed6143 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e5905d431a528cd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/count_tokens.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f84091b9e36e37fc — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/direct_url.ts:8

const client = new GoogleGenAI({apiKey: process.env.GEMINI_API_KEY});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b8e4455a3a241d2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_content_reference.ts:12

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6280c12e4a8b0baf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_content_reference.ts:13

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #833f9203c15d4af8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_content_reference.ts:14

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a19fc32df9ebddbd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_control_reference.ts:12

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d59fdff1b10dfbd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_control_reference.ts:13

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68f63df77620c431 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_control_reference.ts:14

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #779f04ecd532f9ab — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_mask_reference.ts:13

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63871583e20c9968 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_mask_reference.ts:14

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f096cb9fbf86bf34 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_mask_reference.ts:15

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43ccc4b2802a54d1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_style_transfer.ts:8

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3779d4432ead231 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_style_transfer.ts:9

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89a3309177d38977 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_style_transfer.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1796b782a67b6df — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_subject_reference.ts:12

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be1be000fdf2352d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_subject_reference.ts:13

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #844274b1f4519529 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/edit_image_subject_reference.ts:14

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89aaa931e0304ae9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca3439588a2a8d9c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9922a0ea7bfaa14 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef9952dde8dd5fea — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/embed_content.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87830471a88fa312 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/file_search_stores.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9c0d0514b741898 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:16

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5448617c47dcfaa0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:17

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce21bb58b19a693f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:18

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #594c0a2cf8319ac9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_afc_streaming.ts:19

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8145efe2634e96b9 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:7

import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #445915214953eed2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:9

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50efeaab5fa717eb — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:10

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5de7d3a0859d4d2a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:11

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca68fac66a769b55 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:12

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f2bcf5802366358 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:35

      fs.writeFileSync(fileName, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26247e51dc8cd859 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming.ts:65

      fs.writeFileSync(fileName, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55206a488afb159e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming_function_call.ts:12

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #deb7179381652a43 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming_function_call.ts:13

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1605ec91d290f0e0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_streaming_function_call.ts:14

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #340cf8292a8f95b1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3641f2a717a8319e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e18314b5332b83c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4136e0e5bee9ee93 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_code_execution.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d8fe9f2ae94c85d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e88ea1acb0ca856d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_file_upload.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51560745d88c470e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:13

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8dcf01cdb023e0e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:14

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8fa7ece9aae75c44 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:15

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #108b1a9645126f07 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling.ts:16

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cd5b1b028409d15 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:10

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee6d5460594194b9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:11

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ffba00fdef2aa58 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:12

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3ee423551164784 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_function_calling_accept_json_schema.ts:13

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a35f413ae284de57 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #383f425eca044f29 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d78096f166b4e985 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0176cfd13ec8785f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_latlong.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f53e9893daf76641 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c3dc33b617f814e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53800027f6ad8b52 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20ed0381a996a923 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_log_prob.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12ec7bd22203b718 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96f7670a37e6263d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cebf433639e25716 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d3172e133f5e514 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_model_configuration.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c8c6bf2cfa3162d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:8

const GOOGLE_API_KEY = process.env.GOOGLE_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf04a43dbf177aba — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a02d8649408aa407 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ceb2c4fcada44861 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #706b7eb8daf7b77c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:9

const GOOGLE_API_KEY = process.env.GOOGLE_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26f07062030357d8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:10

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22abaa328f4a69a7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:11

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3846ba1829c8e70 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_response_schema_accept_json_schema.ts:12

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6542cd5c8c3cfde7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:13

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9560db5a6cad100 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:14

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5926fdf6c07f09d7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:15

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb5a64d522af80ee — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_safety_settings.ts:16

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c96b3a6b6495d598 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd239275da43f5ae — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #415491bf9dee3d18 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7a884c00acb22c2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_search_grounding.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a032da1b9ff21d1c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32e2c0f812527e3e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b79de332e64d9500 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b75605805c96a75a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_system_instructions.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd9cc743f4f81534 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1336d6d00f960d0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d557ce8475d722d7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76d3286b8c13c4d4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1afe1d87a704625 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text_vertex_apikey.ts:8

const GOOGLE_API_KEY = process.env.GOOGLE_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83fcc16eaa9cc9ab — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_text_vertex_apikey.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e26e68d7a35ace85 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b94bb88655ab654 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_content_with_url_context.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6a6ec2d6e81604a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #938415bba31e2f1a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7868cd9c4e47d0dd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a14e137f3b14c5f9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_image.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d655fd0253c21225 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb5a25b97b9009fc — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b787186e60d9b9d8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9003e57835f08a2b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06f8caecc63d6e9d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_edit_outpaint.ts:8

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a43313994cef8e9a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_edit_outpaint.ts:9

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17e84e31b02423ae — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_edit_outpaint.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5524d8f8868101e5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_extension.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2fb29f51c41099e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_extension.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dacba5c906fb3c6 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_extension.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8542c86de31c72e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_extension.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e25b572b79023290 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7781e89f7a3d7f2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1574a3599aa8b584 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3b621cfa5a02b85 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/generate_videos_rai_filtered.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24bc6c27a66edfe6 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/get_model_info.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7c98e33395fd488 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/get_model_info.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d35727cf462275a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/get_model_info.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9965bd1cb9659733 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/get_model_info.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e0e9cf1f591f09a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_basic.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18d5dd9f1e0c1171 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_basic.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96d21e2dfeea9e98 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0dc6b9afd373b2d3 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_client_state.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4eaab9fd8b1c804b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf1d13285fde324d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_function_calling_server_state.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b9e51e0c3550a5b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb0c9ba8ce2fddac — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_get.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8223bb2b6a56bf4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee7532a3b0a4196d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #567056ea2d25a8f7 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio.ts:19

  const audioResponse = await fetch(audioUrl);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #4ece5a426e0667cf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c4c4a50e99ce249 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #86f88f5999cfb61a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_audio_with_generate_content.ts:19

  const audioResponse = await fetch(audioUrl);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #79cd9d78fb0a4dce — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7795666de6927676 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #21424b7a546ff47a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image.ts:19

  const imageResponse = await fetch(imageUrl);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #9621287b4bc27f86 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb4b41a06c1f2d36 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #4964c7dd7a2d4ebd — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_input_text_and_image_with_generate_content.ts:23

  const imageResponse = await fetch(imageUrl);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #f139138207071f97 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0f54c3e970d5040 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e69c40fe55e109ca — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2feef0310d9a713e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_audio_with_generate_content.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90571a1bed12b69e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7aed247bba9f3ebb — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71897648c6cf36c1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db1ca2464926195f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_multimodal_response_image_with_generate_content.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e838cfca8bc3e2e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8577727f7cbc5d5f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateful.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #347fbb51cd7dfabd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44459acb97c644ba — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_stateless.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44abd03cae595cdf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_streaming.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e8fd935942832bf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_streaming.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc455b6cb087fc15 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_structured_output_json.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b31fdb83a62285f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_structured_output_json.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2324e254ca60aff — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_code_execution.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c466616b302ccdd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_code_execution.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fc07be06aeab4f0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_computer_use.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e23d3e8ffa21bc67 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_computer_use.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d67101e04eee6e0b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_functions.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #578a8784359b5ce5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_functions.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65437ad5c5ddb10c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_google_search.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #558b4d815220de46 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_google_search.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0110071473b36acb — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mcp_server.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bd3f8085ca7447a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mcp_server.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e7fec25129b77c3 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mime_type.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fcc36f399ebee53 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_mime_type.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fcde06276832495d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_url_context.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #296ecece8eb43d1e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_tool_call_with_url_context.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6faf72544af5ada2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_with_config.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f5fcc9249b93fbe — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/interactions_with_config.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a9d50e4a8937115 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/list_models.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fdf9156f2426daf4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/list_models.ts:9

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72e2c9539bec3d0c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/list_models.ts:10

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66e4d23fdd92afd9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/list_models.ts:11

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #913e86d826dd1ac0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:13

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5be2b6bd027a1b4c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:14

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50bddc86f966cae7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:15

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f010e27b927c5082 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:16

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ecdd5db30f36965d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content.ts:18

  process.env.GOOGLE_GENAI_MLDEV_USE_EPHEMERAL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c02274081b01d38e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content_with_url_context.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #863b979980f60e87 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_client_content_with_url_context.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54df201befa00919 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_ephemeral.ts:13

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7dd2ff98696109e6 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_ephemeral.ts:14

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09f0ed77b859445b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_music.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #442363dd57ce996c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_music.ts:9

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1af9e52ed9ad0262 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:9

import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bead6bd322e8321 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:26

  const GOOGLE_API_KEY = process.env.GOOGLE_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e25cc3bcc85bfa17 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:27

  const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08622a48ac73428f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:28

  const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62253d5d0989ac6b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:29

  const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e20f097d6d0e43d — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:55

    const voiceSampleAudio = fs.readFileSync(voiceSamplePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6c38a2c5ba95ad0 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:59

      consentAudio = fs.readFileSync(voiceConsentPath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3bc3277b7511c66a — Filesystem access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_prompt.ts:166

  fs.writeFileSync(filename, fileBuffer);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a78475c788ee1885 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_server.ts:25

const GOOGLE_API_KEY = process.env.GOOGLE_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #707dd9810de994bf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_server.ts:26

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0461cc0b1ee6a428 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_server.ts:27

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c22cae2afc5a13b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/live_server.ts:28

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4558ff6f9c28dc39 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client.ts:12

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c717759875fa0c00 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client.ts:13

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac4933297e57167d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client.ts:14

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1ed0190faae5734 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client.ts:15

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fb2392416a6a5eb — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client_stream.ts:12

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d681d9c8bddaa6bf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client_stream.ts:13

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #850093fd71d09066 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client_stream.ts:14

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eafa33de6819da2e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/mcp_client_stream.ts:15

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e7e7568db6bf9e8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/recontext_image_virtual_try_on.ts:8

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93595d9a993efb24 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/recontext_image_virtual_try_on.ts:9

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43d06508c117f1d0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/recontext_image_virtual_try_on.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe3bd4dd56984ec1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:9

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94faebc00c80ef06 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/register_files.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0380b7803a0e538d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/segment_image.ts:8

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5438e0fa1265b32 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/segment_image.ts:9

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef1567ebb45093de — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/segment_image.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #457630daac61f541 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/trigger_generic_operations.ts:8

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #236fd9a4bc18b1f8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/tunings.ts:8

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0de5c6726be8d00 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/tunings.ts:9

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7508280b15711147 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/tunings.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b9884586ec8e522 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/upscale_image.ts:8

const GOOGLE_CLOUD_PROJECT = process.env.GOOGLE_CLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf616d84bdfcdc89 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/upscale_image.ts:9

const GOOGLE_CLOUD_LOCATION = process.env.GOOGLE_CLOUD_LOCATION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90ddba97a25e9021 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/sdk-samples/upscale_image.ts:10

const GOOGLE_GENAI_USE_VERTEXAI = process.env.GOOGLE_GENAI_USE_VERTEXAI;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #f61cbc9dba62640f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/_api_client.ts:731

      return fetch(url, requestInit);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c0b0972aa60a3b9e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/_api_client.ts:736

      const response = await fetch(url, requestInit);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1dd861be3c779138 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:240

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b3bae7919213a493 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:271

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2a0b53d8f3c53d5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:323

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9fe9e043b200998d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:373

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #93feee6cf4d82cb4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:404

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aca7fc2309138c9e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:452

      await this.apiClient.request({
        path: path,
        queryParams: queryParams,
        body: JSON.stringify(body),
        httpMethod: 'POST',
        httpOptions: params.config?.httpOptions,
        abortSignal: params.config?.abortSignal,
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #18ecda250d3a0295 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:473

      await this.apiClient.request({
        path: path,
        queryParams: queryParams,
        body: JSON.stringify(body),
        httpMethod: 'POST',
        httpOptions: params.config?.httpOptions,
        abortSignal: params.config?.abortSignal,
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #685ccaea09c158c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:501

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #039da058f1b41754 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:536

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #89a549bce6541a5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:595

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'DELETE',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8ebc17982b4ea4dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/batches.ts:632

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'DELETE',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fb69fa8646bc6f10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:92

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #793b9cfa1aab98c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:121

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #76700c0bd5810ad0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:171

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f848a06a975e7110 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:200

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e27c962d77572485 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:250

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'DELETE',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cdbe4415f534af56 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:289

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'DELETE',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8f5fe6477288b0dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:352

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'PATCH',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4054a7d91bc81685 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:381

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'PATCH',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #648bf3f27b625c0d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:417

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d66d76e50cad12fa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/caches.ts:453

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #036c4fb0aec9f18c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/cross/_cross_uploader.ts:149

      response = await apiClient.request({
        path: '',
        body: chunk,
        httpMethod: 'POST',
        httpOptions: {
          ...httpOptions,
          apiVersion: '',
          baseUrl: finalUrl,
          headers: mergedHeaders,
        },
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7c18447341ea03b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/documents.ts:74

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #29302624c0d197a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/documents.ts:116

      await this.apiClient.request({
        path: path,
        queryParams: queryParams,
        body: JSON.stringify(body),
        httpMethod: 'DELETE',
        httpOptions: params.config?.httpOptions,
        abortSignal: params.config?.abortSignal,
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #154556ef4b0e2bfd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/documents.ts:148

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #99691e34132733de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/files.ts:159

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f80c3dca84f14d0e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/files.ts:208

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c936ae6f8d9bbb1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/files.ts:264

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a51c9d2f1d71aad0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/files.ts:317

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'DELETE',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #59afd4af4929a2fc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/files.ts:366

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a5856fa37354bcb0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/filesearchstores.ts:143

    const response = await this.apiClient.request({
      path: pathname,
      httpMethod: 'GET',
      queryParams: queryParams,
      httpOptions: httpOptions,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #502c59de41301991 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/filesearchstores.ts:189

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0da837b9b4d47896 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/filesearchstores.ts:236

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5a905fb02b82d9b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/filesearchstores.ts:278

      await this.apiClient.request({
        path: path,
        queryParams: queryParams,
        body: JSON.stringify(body),
        httpMethod: 'DELETE',
        httpOptions: params.config?.httpOptions,
        abortSignal: params.config?.abortSignal,
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cf66f674d3d20e25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/filesearchstores.ts:310

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #80a9fd2d422e3958 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/filesearchstores.ts:354

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d8b133f61c3584a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/filesearchstores.ts:409

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7ec73e30667e8b02 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/gaos/lib/http.ts:26

    return fetch(input);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #460f912b33bcf356 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/gaos/lib/http.ts:28

    return fetch(input, init);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b58af51a308f9f5b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/gaos/lib/sdks.ts:357

        let response = await this._httpClient.request(req);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #eaf22c8514b46551 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:704

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1242deed87b3f9ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:746

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e1517eb7ad7829e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:916

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #26a0c8da6b4b3937 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:958

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9559348ae0bffe39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1013

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #920eac8db6a39980 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1055

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #071aced03651d952 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1110

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #75766819490dfae8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1169

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #979ef5d22e6a50c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1249

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7c476efa74bdd541 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1319

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a2b67ade195ad810 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1375

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c4d581f1d3dfd49c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1407

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f857e8e8f2f81abe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1449

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #22ac202b11a4e49a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1491

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f35203d5b25f5560 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1558

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'PATCH',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5f4d5038a4cbbec5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1590

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'PATCH',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a75ce9fe587628b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1643

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'DELETE',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8831f109cc872122 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1685

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'DELETE',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f602d4c20f7548a7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1753

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2063af58f31a131e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1795

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #842471ec067ee235 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1865

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dda819dcb4752852 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1924

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dd6aee8b2da56413 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/models.ts:1960

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #96baf5a1bc8097d5 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/node/_node_downloader.ts:7

import {createWriteStream} from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5488a364a0cbc43e — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/node/_node_downloader.ts:8

import {writeFile} from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0025570b4986fba5 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/node/_node_downloader.ts:39

          await writeFile(params.downloadPath, response as string, {
            encoding: 'base64',
          });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #f44ef393b6cebead — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/node/_node_downloader.ts:58

    return await apiClient.request({
      path: `files/${name}:download`,
      httpMethod: 'GET',
      queryParams: {
        'alt': 'media',
      },
      httpOptions: params.config?.httpOptions,
      abortSignal: params.config?.abortSignal,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #29928d94cfde4976 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/node/_node_tokenizer_platform.ts:8

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8905b6d0c4ea6862 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/node/_node_tokenizer_platform.ts:34

      const data = await fs.readFile(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6efb324a0aefad3 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/node/_node_tokenizer_platform.ts:55

      await fs.writeFile(tmpPath, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #bf6ec931f1ccb1e9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/node/_node_tokenizer_platform.ts:78

    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #0974e3f67aa4ee9d — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/node/_node_uploader.ts:6

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #fb12667b36d58ffe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/node/_node_uploader.ts:290

          response = await apiClient.request({
            path: '',
            body: chunk,
            httpMethod: 'POST',
            httpOptions: {
              ...httpOptions,
              apiVersion: '',
              baseUrl: finalUrl,
              headers: mergedHeaders,
            },
          });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #34fee80683e704ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/operations.ts:132

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3089c901cd1ca684 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/operations.ts:156

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5ac744823d44b9f7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/operations.ts:190

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dbb02c43d8531401 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tokens.ts:286

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(transformedBody),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #462776e3ace6be79 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:136

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #53e7083164e3d707 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:170

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3ce8a25ccc55a03a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:214

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'GET',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f620aafff59c0071 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:277

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5d7c15054b1d6812 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:315

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #39b703b87755c5c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:366

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #27a741da4d2972a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:421

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e031d4cbb42dbcd0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/tunings.ts:465

      response = this.apiClient
        .request({
          path: path,
          queryParams: queryParams,
          body: JSON.stringify(body),
          httpMethod: 'POST',
          httpOptions: params.config?.httpOptions,
          abortSignal: params.config?.abortSignal,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

axios

npm dependency

medium pii_flow dependency Excluded from app score #18199de788fe7e21 — Credentials parsed from the request URL are applied as authorization on the same outbound HTTP request. This is intentional URL authentication, not unexpected data exfiltration.

pkgs/npm/[email protected]/lib/adapters/http.js:1062 · flow /tmp/closeopen-imo_y475/pkgs/npm/[email protected]/lib/adapters/http.js:861 → /tmp/closeopen-imo_y475/pkgs/npm/[email protected]/lib/adapters/http.js:1062

      req = transport.request(options, function handleResponse(res) {
        clearConnectPhaseTimer();

        if (req.destroyed) return;

        const streams = [res];

        const responseLength = utils.toFiniteNumber(res.headers['content-length']);

        if (onDownloadProgress || maxDownloadRate) {
          const transformStream = new AxiosTransformStream({
            maxRate: utils.toFiniteNumber(maxDownloadRate),
          });

          onDownloadProgress &&
            transformStream.on(
              'progress',
              flushOnFinish(
                transformStream,
                progressEventDecorator(
                  responseLength,
                  progressEventReducer(asyncDecorator(onDownloadProgress), true, 3)
                )
              )
            );

          streams.push(transformStream);
        }

        // decompress the response body transparently if required
        let responseStream = res;

        // return the last request in case of redirects
        const lastRequest = res.req || req;

        // if decompress disabled we should not decompress
        if (decompress !== false && res.headers['content-encoding']) {
          // if no content, but headers still say that it is encoded,
          // remove the header not confuse downstream operations
          if (method === 'HEAD' || res.statusCode === 204) {
            delete res.headers['content-encoding'];
          }

          switch ((res.headers['content-encoding'] || '').toLowerCase()) {
            /*eslint default-case:0*/
            case 'gzip':
            case 'x-gzip':
            case 'compress':
            case 'x-compress':
              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'deflate':
              streams.push(new ZlibHeaderTransformStream());

              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'br':
              if (isBrotliSupported) {
                streams.push(zlib.createBrotliDecompress(brotliOptions));
                delete res.headers['content-encoding'];
              }
              break;
            case 'zstd':
              if (isZstdSupported) {
                streams.push(zlib.createZstdDecompress(zstdOptions));
                delete res.headers['content-encoding'];
              }
              break;
          }
        }

        responseStream = streams.length > 1 ? stream.pipeline(streams, utils.noop) : streams[0];

        const response = {
          status: res.statusCode,
          statusText: res.statusMessage,
          headers: new AxiosHeaders(res.headers),
          config,
          request: lastRequest,
        };

        if (responseType === 'stream') {
          // Enforce maxContentLength on streamed responses; previously this
          // was applied only to buffered responses.
          if (maxContentLength > -1) {
            const limit = maxContentLength;
            const source = responseStream;
            async function* enforceMaxContentLength() {
              let totalResponseBytes = 0;
              for await (const chunk of source) {
                totalResponseBytes += chunk.length;
                if (totalResponseBytes > limit) {
                  throw new AxiosError(
                    'maxContentLength size of ' + limit + ' exceeded',
                    AxiosError.ERR_BAD_RESPONSE,
                    config,
                    lastRequest
                  );
                }
                yield chunk;
              }
            }
            responseStream = stream.Readable.from(enforceMaxContentLength(), {
              objectMode: false,
            });
          }
          response.data = responseStream;
          settle(resolve, reject, response);
        } else {
          const responseBuffer = [];
          let totalResponseBytes = 0;

          responseStream.on('data', function handleStreamData(chunk) {
            responseBuffer.push(chunk);
            totalResponseBytes += chunk.length;

            // make sure the content length is not over the maxContentLength if specified
            if (maxContentLength > -1 && totalResponseBytes > maxContentLength) {
              // stream.destroy() emit aborted event before calling reject() on Node.js v16
              rejected = true;
              responseStream.destroy();
              abort(
                new AxiosError(
                  'maxContentLength size of ' + maxContentLength + ' exceeded',
                  AxiosError.ERR_BAD_RESPONSE,
                  config,
                  lastRequest
                )
              );
            }
          });

          responseStream.on('aborted', function handlerStreamAborted() {
            if (rejected) {
              return;
            }

            const err = new AxiosError(
              'stream has been aborted',
              AxiosError.ERR_BAD_RESPONSE,
              config,
              lastRequest,
              response
            );
            responseStream.destroy(err);
            reject(err);
          });

          responseStream.on('error', function handleStreamError(err) {
            if (rejected) return;
            reject(AxiosError.from(err, null, config, lastRequest, response));
          });

          responseStream.on('end', function handleStreamEnd() {
            try {
              let responseData =
                responseBuffer.length === 1 ? responseBuffer[0] : Buffer.concat(responseBuffer);
              if (responseType !== 'arraybuffer') {
                responseData = responseData.toString(responseEncoding);
                if (!responseEncoding || responseEncoding === 'utf8') {
                  responseData = utils.stripBOM(responseData);
                }
              }
              response.data = responseData;
            } catch (err) {
              return reject(AxiosError.from(err, null, config, response.request, response));
            }
            settle(resolve, reject, response);
          });
        }

        abortEmitter.once('abort', (err) => {
          if (!responseStream.destroyed) {
            responseStream.emit('error', err);
            responseStream.destroy();
          }
        });
      });

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

expand_more 3 low-confidence finding(s)

low egress dependency Excluded from app score #f698213080e7b707 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/lib/adapters/http.js:494

    const req = session.request(http2Headers);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #daf810f13e30ddf0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/lib/adapters/http.js:1062

      req = transport.request(options, function handleResponse(res) {
        clearConnectPhaseTimer();

        if (req.destroyed) return;

        const streams = [res];

        const responseLength = utils.toFiniteNumber(res.headers['content-length']);

        if (onDownloadProgress || maxDownloadRate) {
          const transformStream = new AxiosTransformStream({
            maxRate: utils.toFiniteNumber(maxDownloadRate),
          });

          onDownloadProgress &&
            transformStream.on(
              'progress',
              flushOnFinish(
                transformStream,
                progressEventDecorator(
                  responseLength,
                  progressEventReducer(asyncDecorator(onDownloadProgress), true, 3)
                )
              )
            );

          streams.push(transformStream);
        }

        // decompress the response body transparently if required
        let responseStream = res;

        // return the last request in case of redirects
        const lastRequest = res.req || req;

        // if decompress disabled we should not decompress
        if (decompress !== false && res.headers['content-encoding']) {
          // if no content, but headers still say that it is encoded,
          // remove the header not confuse downstream operations
          if (method === 'HEAD' || res.statusCode === 204) {
            delete res.headers['content-encoding'];
          }

          switch ((res.headers['content-encoding'] || '').toLowerCase()) {
            /*eslint default-case:0*/
            case 'gzip':
            case 'x-gzip':
            case 'compress':
            case 'x-compress':
              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'deflate':
              streams.push(new ZlibHeaderTransformStream());

              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'br':
              if (isBrotliSupported) {
                streams.push(zlib.createBrotliDecompress(brotliOptions));
                delete res.headers['content-encoding'];
              }
              break;
            case 'zstd':
              if (isZstdSupported) {
                streams.push(zlib.createZstdDecompress(zstdOptions));
                delete res.headers['content-encoding'];
              }
              break;
          }
        }

        responseStream = streams.length > 1 ? stream.pipeline(streams, utils.noop) : streams[0];

        const response = {
          status: res.statusCode,
          statusText: res.statusMessage,
          headers: new AxiosHeaders(res.headers),
          config,
          request: lastRequest,
        };

        if (responseType === 'stream') {
          // Enforce maxContentLength on streamed responses; previously this
          // was applied only to buffered responses.
          if (maxContentLength > -1) {
            const limit = maxContentLength;
            const source = responseStream;
            async function* enforceMaxContentLength() {
              let totalResponseBytes = 0;
              for await (const chunk of source) {
                totalResponseBytes += chunk.length;
                if (totalResponseBytes > limit) {
                  throw new AxiosError(
                    'maxContentLength size of ' + limit + ' exceeded',
                    AxiosError.ERR_BAD_RESPONSE,
                    config,
                    lastRequest
                  );
                }
                yield chunk;
              }
            }
            responseStream = stream.Readable.from(enforceMaxContentLength(), {
              objectMode: false,
            });
          }
          response.data = responseStream;
          settle(resolve, reject, response);
        } else {
          const responseBuffer = [];
          let totalResponseBytes = 0;

          responseStream.on('data', function handleStreamData(chunk) {
            responseBuffer.push(chunk);
            totalResponseBytes += chunk.length;

            // make sure the content length is not over the maxContentLength if specified
            if (maxContentLength > -1 && totalResponseBytes > maxContentLength) {
              // stream.destroy() emit aborted event before calling reject() on Node.js v16
              rejected = true;
              responseStream.destroy();
              abort(
                new AxiosError(
                  'maxContentLength size of ' + maxContentLength + ' exceeded',
                  AxiosError.ERR_BAD_RESPONSE,
                  config,
                  lastRequest
                )
              );
            }
          });

          responseStream.on('aborted', function handlerStreamAborted() {
            if (rejected) {
              return;
            }

            const err = new AxiosError(
              'stream has been aborted',
              AxiosError.ERR_BAD_RESPONSE,
              config,
              lastRequest,
              response
            );
            responseStream.destroy(err);
            reject(err);
          });

          responseStream.on('error', function handleStreamError(err) {
            if (rejected) return;
            reject(AxiosError.from(err, null, config, lastRequest, response));
          });

          responseStream.on('end', function handleStreamEnd() {
            try {
              let responseData =
                responseBuffer.length === 1 ? responseBuffer[0] : Buffer.concat(responseBuffer);
              if (responseType !== 'arraybuffer') {
                responseData = responseData.toString(responseEncoding);
                if (!responseEncoding || responseEncoding === 'utf8') {
                  responseData = utils.stripBOM(responseData);
                }
              }
              response.data = responseData;
            } catch (err) {
              return reject(AxiosError.from(err, null, config, response.request, response));
            }
            settle(resolve, reject, response);
          });
        }

        abortEmitter.once('abort', (err) => {
          if (!responseStream.destroyed) {
            responseStream.emit('error', err);
            responseStream.destroy();
          }
        });
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #e21dd2ffa091cb34 — Environment-variable access.

pkgs/npm/[email protected]/lib/helpers/shouldBypassProxy.js:168

  const noProxy = (process.env.no_proxy || process.env.NO_PROXY || '').toLowerCase();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@modelcontextprotocol/sdk

npm dependency

expand_more 38 low-confidence finding(s)

low egress tooling Excluded from app score unknown #7a1e3d98d4913e71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/scripts/cli.ts:54

    await client.request({ method: 'resources/list' }, ListResourcesResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #ce329ee30dfb1345 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:16

    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #66ef6a57fcf15d8f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:32

    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unknown #3b3e6f32a1a78885 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:77

        writeFileSync(outputPath, fullContent, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24fb35de7d0ab11a — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/client/stdio.ts:71

        const value = process.env[key];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #fd46bfa28a910da1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:632

        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f4f010005d96085c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:663

        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #c761609f250de3fe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/multipleClientsParallel.ts:64

        const result = await client.request(toolRequest, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #c3b82458b362b792 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:95

        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #1f62f0c71887ebf4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:167

            return client
                .request(request, CallToolResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unknown #0d73e88bc60ae978 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:26

const DEFAULT_SERVER_URL = process.env.MCP_SERVER_URL || 'http://localhost:3000/mcp';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #6787eedaf12f2abf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:29

    const clientId = process.env.MCP_CLIENT_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9e24bd18a981c09f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:36

    const privateKeyPem = process.env.MCP_CLIENT_PRIVATE_KEY_PEM;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #c52695f74aa147e5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:38

        const algorithm = process.env.MCP_CLIENT_ALGORITHM || 'RS256';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #61af89b2ef866dd1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:48

    const clientSecret = process.env.MCP_CLIENT_SECRET;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #70a6e5f508d9d03f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:232

            const result = await this.client.request(request, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #a8e90377563f50de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:290

            const result = await this.client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #3c2c43e01930e874 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:510

                const resourcesResult = await client.request(
                    {
                        method: 'resources/list',
                        params: {}
                    },
                    ListResourcesResultSchema
                );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #c15b10d2c8e8bd39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:601

        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #956176fd2b9cdc39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:632

        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #9b28b38c29699e70 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:719

        const result = await client.request(request, CallToolResultSchema, {
            resumptionToken: notificationsToolLastEventId,
            onresumptiontoken: onLastEventIdUpdate
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #21e8e3fb8da0bdd2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:748

        const promptsResult = await client.request(promptsRequest, ListPromptsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #c1ccb6bfb143d4be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:777

        const promptResult = await client.request(promptRequest, GetPromptResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #498422172709eac3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:798

        const resourcesResult = await client.request(resourcesRequest, ListResourcesResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #246a9679ff1cd8d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:826

        const result = await client.request(request, ReadResourceResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #5de5e829cd6d54e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/ssePollingClient.ts:75

        const result = await client.request(
            {
                method: 'tools/call',
                params: {
                    name: 'long-task',
                    arguments: {}
                }
            },
            CallToolResultSchema,
            {
                // Track resumption tokens for debugging
                onresumptiontoken: token => {
                    lastEventId = token;
                    console.log(`[Event ID] ${token}`);
                }
            }
        );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #09ba3ec38449287d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:139

        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f9a4469faba28f31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:172

        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unknown #88171751ad23c093 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationFormExample.ts:350

    const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9c72881f75c8bff7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:215

const MCP_PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #7dd7780f64bc4a9d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:216

const AUTH_PORT = process.env.MCP_AUTH_PORT ? parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #84ccaa3be60e0ac1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:245

        const response = await fetch(endpoint, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded'
            },
            body: new URLSearchParams({
                token: token
            }).toString()
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unknown #fc270ab7b55b3cad — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/server/honoWebStandardStreamableHttp.ts:69

const PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #ae45acaa48e92cd5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:621

const MCP_PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #80b949b57f4a345d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:622

const AUTH_PORT = process.env.MCP_AUTH_PORT ? parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #c5340eaa6f27c5f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:643

            const response = await fetch(endpoint, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/x-www-form-urlencoded'
                },
                body: new URLSearchParams({
                    token: token
                }).toString()
            });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unknown #142b93dcef5e559b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleTaskInteractive.ts:448

const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 8000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #923d7eb1efe0de51 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/src/server/auth/router.ts:12

    process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === 'true' || process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === '1';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@types/adm-zip

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #61769b7ab30a39b1 — Filesystem access.

pkgs/npm/@[email protected]/index.d.ts:3

import * as FS from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ac6df61b03aa33c — Filesystem access.

pkgs/npm/@[email protected]/ts5.6/index.d.ts:3

import * as FS from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

adm-zip

npm dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #d4e4c43e65838b95 — Filesystem access.

pkgs/npm/[email protected]/adm-zip.js:72

            inBuffer = filetools.fs.readFileSync(input);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e77ad542ce06b18 — Filesystem access.

pkgs/npm/[email protected]/adm-zip.js:324

                const data = _attr.isFile() ? filetools.fs.readFileSync(localPath) : Buffer.alloc(0);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c8027c32b083cc2 — Filesystem access.

pkgs/npm/[email protected]/adm-zip.js:371

                    filetools.fs.readFile(localPath, function (err, data) {
                        if (err) return callback(err, false);
                        self.addFile(zipPath, data, comment, stats);
                        return setImmediate(callback, undefined, true);
                    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fc82da49e06f949 — Filesystem access.

pkgs/npm/[email protected]/adm-zip.js:459

                                        filetools.fs.readFile(filepath, function (er1, data) {
                                            if (er1) {
                                                callback(undefined, er1);
                                            } else {
                                                self.addFile(zipPath + p, data, "", stats);
                                                next();
                                            }
                                        });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #998ad56367b1345f — Filesystem access.

pkgs/npm/[email protected]/types.d.ts:3

import type { Stats } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d56c77a32ca7c674 — Filesystem access.

pkgs/npm/[email protected]/util/utils.js:1

const fsystem = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

better-sqlite3

npm dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #60c62fa4e1e86955 — Filesystem access.

pkgs/npm/[email protected]/deps/copy.js:3

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9eccbc8ed5bb505b — Filesystem access.

pkgs/npm/[email protected]/lib/binding.js:2

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2fde53464a5ab5a4 — Filesystem access.

pkgs/npm/[email protected]/lib/database.js:2

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d359ff7d2f1d5d1b — Filesystem access.

pkgs/npm/[email protected]/lib/methods/backup.js:2

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

dotenv

npm dependency

expand_more 18 low-confidence finding(s)

low env_fs dependency Excluded from app score #0d4894a2711bf017 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:4

if (process.env.DOTENV_CONFIG_ENCODING != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #148addcd936a237f — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:5

  options.encoding = process.env.DOTENV_CONFIG_ENCODING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b32381e224204bd0 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:8

if (process.env.DOTENV_CONFIG_PATH != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff3748ab923cdb26 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:9

  options.path = process.env.DOTENV_CONFIG_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92fd558731657913 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:12

if (process.env.DOTENV_CONFIG_QUIET != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fea78a51b54ec76 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:13

  options.quiet = process.env.DOTENV_CONFIG_QUIET

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd3e12ee48d6c691 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:16

if (process.env.DOTENV_CONFIG_DEBUG != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96c06fd1a533667d — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:17

  options.debug = process.env.DOTENV_CONFIG_DEBUG

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d7d0e32220245dd — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:20

if (process.env.DOTENV_CONFIG_OVERRIDE != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e119e728af0a1b4 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:21

  options.override = process.env.DOTENV_CONFIG_OVERRIDE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e35f671d6a532ac — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:24

if (process.env.DOTENV_CONFIG_DOTENV_KEY != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bcbe2aa91c90866 — Environment-variable access.

pkgs/npm/[email protected]/lib/env-options.js:25

  options.DOTENV_KEY = process.env.DOTENV_CONFIG_DOTENV_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00b0261f94b33cab — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:1

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4cc08d7a5d0d501 — Environment-variable access.

pkgs/npm/[email protected]/lib/main.js:141

  if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c791f3121aac73d — Environment-variable access.

pkgs/npm/[email protected]/lib/main.js:142

    return process.env.DOTENV_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b836d6103f49949 — Environment-variable access.

pkgs/npm/[email protected]/lib/main.js:221

  const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || (options && options.debug))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18896fc6090d05fa — Environment-variable access.

pkgs/npm/[email protected]/lib/main.js:222

  const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || (options && options.quiet))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba33404a2c44f44a — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:277

      const parsed = DotenvModule.parse(fs.readFileSync(path, { encoding }))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

express

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #c4929c56ff87d639 — Environment-variable access.

pkgs/npm/[email protected]/lib/application.js:91

  var env = process.env.NODE_ENV || 'development';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gpt-tokenizer

npm dependency

expand_more 24 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #ee86612988d0bc70 — Filesystem access.

pkgs/npm/[email protected]/cjs/GptEncoding.test.js:39

const fs_1 = __importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #36f5a1a210f461e3 — Filesystem access.

pkgs/npm/[email protected]/cjs/GptEncoding.test.js:418

    const testPlanData = fs_1.default.readFileSync(testPlanPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #0631f9099b4554e9 — Filesystem access.

pkgs/npm/[email protected]/esm/GptEncoding.test.js:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #8bfd9ae857d30d2d — Filesystem access.

pkgs/npm/[email protected]/esm/GptEncoding.test.js:381

    const testPlanData = fs.readFileSync(testPlanPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d0f8b811ed98f74 — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateByModel.js:1

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #847c8fa0ef08a3fc — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateByModel.js:35

const template = await fs.readFile(path.join(__dirname, '../encoding/cl100k_base.ts'), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #740a203c814066eb — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateByModel.js:68

    await fs.writeFile(path.join(__dirname, `../model/${modelName}.ts`), content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5566db379b852d20 — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:2

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93098132f043641c — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:20

await fs.writeFile(path.join(__dirname, '../modelsChatEnabled.gen.ts'), tsFileContent);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2420c47f7515235 — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:2

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9f6f7d55876b11d — Environment-variable access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:5

const DEBUG = process.env.DEBUG === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a4710f41444a48a — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:47

    const bpeFile = await fs.readFile(filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c05e398b2e7855cc — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:105

    await fs.writeFile(path.join(__dirname, `../bpeRanks/${modelName}.js`), `${preamble}
${jsCodeConstsForEachChunk.join('\n')}
/** @type {(string | number[])[]} */
const bpe = ${jsCodeBpeArray};
${jsCodeToResetHelperArrays.join('\n')}
export default bpe;`);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #93b8f1b238d602f3 — Filesystem access.

pkgs/npm/[email protected]/src/GptEncoding.test.ts:1

import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #004bf955f863ad18 — Filesystem access.

pkgs/npm/[email protected]/src/GptEncoding.test.ts:500

  const testPlanData = fs.readFileSync(testPlanPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfbfbb56e8ee266f — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateByModel.ts:1

import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3353574331be6134 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateByModel.ts:55

const template = await fs.readFile(
  path.join(__dirname, '../encoding/cl100k_base.ts'),
  'utf8',
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f62a9b89ea2976e — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateByModel.ts:111

    await fs.writeFile(
      path.join(__dirname, `../model/${modelName}.ts`),
      content,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ce534318bf8398d — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:2

import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #233c8195e7c2780e — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:31

await fs.writeFile(
  path.join(__dirname, '../modelsChatEnabled.gen.ts'),
  tsFileContent,
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce3b3906bafc3403 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:2

import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a3f7470dcff4552 — Environment-variable access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:7

const DEBUG = process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e132f5ec8d42af2f — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:57

    const bpeFile = await fs.readFile(filePath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afddb9adf9f76ebc — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:138

    await fs.writeFile(
      path.join(__dirname, `../bpeRanks/${modelName}.js`),
      `${preamble}
${jsCodeConstsForEachChunk.join('\n')}
/** @type {(string | number[])[]} */
const bpe = ${jsCodeBpeArray};
${jsCodeToResetHelperArrays.join('\n')}
export default bpe;`,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

i18next-fs-backend

npm dependency

expand_more 37 low-confidence finding(s)

low env_fs dependency Excluded from app score #9848e425a01aa80c — Filesystem access.

pkgs/npm/[email protected]/cjs/index.js:140

            this.writeFile(lng, ns);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b527d596861ea77 — Filesystem access.

pkgs/npm/[email protected]/cjs/readFile.js:21

  var data = fs.readFileSync(filename, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72013ad09aa73d92 — Filesystem access.

pkgs/npm/[email protected]/cjs/readFile.js:33

    fs.readFile(filename, 'utf8', function (err, data) {
      if (err) return reject(err);
      fs.stat(filename, function (err, stat) {
        if (err) return resolve({
          data: data
        });
        return resolve({
          data: data,
          stat: stat
        });
      });
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc14ff4aae379bcb — Filesystem access.

pkgs/npm/[email protected]/cjs/readFile.js:49

  var d = Deno.readFileSync(filename);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23fa795605383901 — Filesystem access.

pkgs/npm/[email protected]/cjs/readFile.js:63

    Deno.readFile(filename).then(function (d) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c013e9236d62847 — Filesystem access.

pkgs/npm/[email protected]/cjs/writeFile.js:47

  return fs.writeFileSync(filename, payload, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f69ca7219ee8f9bc — Filesystem access.

pkgs/npm/[email protected]/cjs/writeFile.js:54

      fs.writeFile(filename, payload, 'utf8', function (err, data) {
        return err ? reject(err) : resolve(data);
      });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #699b9a47491d2792 — Filesystem access.

pkgs/npm/[email protected]/cjs/writeFile.js:78

  Deno.writeFileSync(filename, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58140fb85b728a45 — Filesystem access.

pkgs/npm/[email protected]/cjs/writeFile.js:87

      Deno.writeFile(filename, data).then(resolve, reject);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ece260ba71a36ff — Filesystem access.

pkgs/npm/[email protected]/cjs/writeFile.js:89

      Deno.writeFile(filename, data).then(resolve, reject);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38bc919cf301e4f3 — Filesystem access.

pkgs/npm/[email protected]/esm/index.js:58

          var _readFileSync = readFileSync(filename, this.options),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b41ae8ff460f7580 — Filesystem access.

pkgs/npm/[email protected]/esm/index.js:72

      readFile(filename, this.options).then(function (_ref) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #206ce472f757ea3a — Filesystem access.

pkgs/npm/[email protected]/esm/index.js:134

            this.writeFile(lng, ns);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bdcbe25fd42dd7c0 — Filesystem access.

pkgs/npm/[email protected]/esm/index.js:179

          _writeFile(filename, data, _this4.options).then(proceedWrite).catch(proceedWrite);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7849ba3df0ef5323 — Filesystem access.

pkgs/npm/[email protected]/esm/index.js:181

        readFile(filename, this.options).then(proceed).catch(function () {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #939257400caa1689 — Filesystem access.

pkgs/npm/[email protected]/esm/readFile.js:11

  var data = fs.readFileSync(filename, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #150bb2db10174556 — Filesystem access.

pkgs/npm/[email protected]/esm/readFile.js:23

    fs.readFile(filename, 'utf8', function (err, data) {
      if (err) return reject(err);
      fs.stat(filename, function (err, stat) {
        if (err) return resolve({
          data: data
        });
        return resolve({
          data: data,
          stat: stat
        });
      });
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79b1146e79912f74 — Filesystem access.

pkgs/npm/[email protected]/esm/readFile.js:39

  var d = Deno.readFileSync(filename);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f99e5cbb381130b — Filesystem access.

pkgs/npm/[email protected]/esm/readFile.js:53

    Deno.readFile(filename).then(function (d) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8359d76dcf64c813 — Filesystem access.

pkgs/npm/[email protected]/esm/writeFile.js:35

  return fs.writeFileSync(filename, payload, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0dbdaca78066bca1 — Filesystem access.

pkgs/npm/[email protected]/esm/writeFile.js:42

      fs.writeFile(filename, payload, 'utf8', function (err, data) {
        return err ? reject(err) : resolve(data);
      });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3e292c0af804c47 — Filesystem access.

pkgs/npm/[email protected]/esm/writeFile.js:66

  Deno.writeFileSync(filename, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #478e0b5b05eb22fd — Filesystem access.

pkgs/npm/[email protected]/esm/writeFile.js:75

      Deno.writeFile(filename, data).then(resolve, reject);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d736144f4f3908c — Filesystem access.

pkgs/npm/[email protected]/esm/writeFile.js:77

      Deno.writeFile(filename, data).then(resolve, reject);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dc94559ad52c0a4 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:44

        const { data, stat } = readFileSync(filename, this.options)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2701f613addd8d31 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:56

    readFile(filename, this.options)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e28b9c6d53d6a819 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:116

          this.writeFile(lng, ns)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #506fc43ba5b96bba — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:170

      readFile(filename, this.options).then(proceed).catch(() => proceed({ data: {} }))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #feeb3f1ac6e2fec2 — Filesystem access.

pkgs/npm/[email protected]/lib/readFile.js:13

  const data = fs.readFileSync(filename, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a8d84e43ce0d246 — Filesystem access.

pkgs/npm/[email protected]/lib/readFile.js:23

    fs.readFile(filename, 'utf8', (err, data) => {
      if (err) return reject(err)
      fs.stat(filename, (err, stat) => {
        if (err) return resolve({ data })
        return resolve({ data, stat })
      })
    })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7fb8aaecef9ec51 — Filesystem access.

pkgs/npm/[email protected]/lib/readFile.js:36

  const d = Deno.readFileSync(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa188ca0d61cc052 — Filesystem access.

pkgs/npm/[email protected]/lib/readFile.js:49

    Deno.readFile(filename).then((d) => {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04011c43ae530a48 — Filesystem access.

pkgs/npm/[email protected]/lib/writeFile.js:37

  return fs.writeFileSync(filename, payload, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97a7e82e3bec111b — Filesystem access.

pkgs/npm/[email protected]/lib/writeFile.js:43

      fs.writeFile(filename, payload, 'utf8', (err, data) => err ? reject(err) : resolve(data))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24992a6a3bf6113f — Filesystem access.

pkgs/npm/[email protected]/lib/writeFile.js:64

  Deno.writeFileSync(filename, data)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbdbd1c1061d516d — Filesystem access.

pkgs/npm/[email protected]/lib/writeFile.js:74

      Deno.writeFile(filename, data).then(resolve, reject)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8618cc47fa07354c — Filesystem access.

pkgs/npm/[email protected]/lib/writeFile.js:77

      Deno.writeFile(filename, data).then(resolve, reject)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

js-yaml

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #6fff5a222fbd67b1 — Filesystem access.

pkgs/npm/[email protected]/bin/js-yaml.js:5

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cee5f0d98d081893 — Filesystem access.

pkgs/npm/[email protected]/bin/js-yaml.js:65

    fs.readFile(filename, encoding, callback)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

multer

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #4f88cb86842cd173 — Filesystem access.

pkgs/npm/[email protected]/storage/disk.js:1

var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

npm dependency

expand_more 363 low-confidence finding(s)

low egress dependency Excluded from app score #f9619717e1246ca2 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.js:50

            const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d802d589abca9fe4 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.js:97

            const url = new URL(`http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7546adca17587963 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.mjs:44

            const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a4adbb97c1bbbabe — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.mjs:91

            const url = new URL(`http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #9c0d1063555d4417 — Environment-variable access.

pkgs/npm/[email protected]/azure.js:44

                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b68b4f14b4105821 — Environment-variable access.

pkgs/npm/[email protected]/azure.mjs:40

                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #6c2a3a15be8ef492 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/admin-api-keys.js:39

        return this._client.get((0, path_1.path) `/organization/admin_api_keys/${keyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2898a49710a73bba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/admin-api-keys.mjs:36

        return this._client.get(path `/organization/admin_api_keys/${keyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f77f246b9a1c491f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/certificates.js:44

        return this._client.get((0, path_1.path) `/organization/certificates/${certificateID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a106814fa1f44a37 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/certificates.js:62

        return this._client.post((0, path_1.path) `/organization/certificates/${certificateID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #763d0a81fa71db05 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/certificates.mjs:41

        return this._client.get(path `/organization/certificates/${certificateID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #44a38a2e1fd6e987 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/certificates.mjs:59

        return this._client.post(path `/organization/certificates/${certificateID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #19b20487ae19fb69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/groups.js:48

        return this._client.get((0, path_1.path) `/organization/groups/${groupID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #098e2c06725f8907 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/groups.js:65

        return this._client.post((0, path_1.path) `/organization/groups/${groupID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3237b3eeadcb242f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/groups.mjs:44

        return this._client.get(path `/organization/groups/${groupID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8e2532dbe43ec1ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/groups.mjs:61

        return this._client.post(path `/organization/groups/${groupID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3a34467620f80bc4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/roles.js:22

        return this._client.post((0, path_1.path) `/organization/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2fa2b4ae893eef3a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/roles.js:42

        return this._client.get((0, path_1.path) `/organization/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #82e050b430f49a7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/roles.mjs:19

        return this._client.post(path `/organization/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cdfe347cfbbe2f43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/roles.mjs:39

        return this._client.get(path `/organization/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2a588595fd946c59 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/users.js:22

        return this._client.post((0, path_1.path) `/organization/groups/${groupID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d9d2d7f2bb386adc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/users.js:42

        return this._client.get((0, path_1.path) `/organization/groups/${group_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3a9319be3a1d8971 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/users.mjs:19

        return this._client.post(path `/organization/groups/${groupID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1f75b47b2948acc4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/groups/users.mjs:39

        return this._client.get(path `/organization/groups/${group_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f78d91bac4f695ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/invites.js:41

        return this._client.get((0, path_1.path) `/organization/invites/${inviteID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f8af24f99713d1fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/invites.mjs:38

        return this._client.get(path `/organization/invites/${inviteID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0f928a2e460a615d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/api-keys.js:23

        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/api_keys/${apiKeyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2f3e6562ea0836cc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/api-keys.mjs:20

        return this._client.get(path `/organization/projects/${project_id}/api_keys/${apiKeyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dcd8a038c6bf180f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.js:20

        return this._client.get((0, path_1.path) `/organization/projects/${projectID}/data_retention`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d078cbe49fdecb1c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.js:38

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/data_retention`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #293e4651cb504ccd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.mjs:17

        return this._client.get(path `/organization/projects/${projectID}/data_retention`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #369f230ec377cc14 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.mjs:35

        return this._client.post(path `/organization/projects/${projectID}/data_retention`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0d443734de526ac5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.js:29

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/groups`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7ffc2fa7c8673f57 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.js:49

        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/groups/${groupID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7a87ac4608909b3a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.mjs:25

        return this._client.post(path `/organization/projects/${projectID}/groups`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c3abe08373221570 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.mjs:45

        return this._client.get(path `/organization/projects/${project_id}/groups/${groupID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2476fd7e93762a2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.js:23

        return this._client.post((0, path_1.path) `/projects/${project_id}/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e1fa7cd3d5f1bfe7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.js:43

        return this._client.get((0, path_1.path) `/projects/${project_id}/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2595d14e858877ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.mjs:20

        return this._client.post(path `/projects/${project_id}/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f6bd4827e20e5dc4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.mjs:40

        return this._client.get(path `/projects/${project_id}/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2d8209ca09f4b396 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.js:20

        return this._client.get((0, path_1.path) `/organization/projects/${projectID}/hosted_tool_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #53170132e9b83f9b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.js:37

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/hosted_tool_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b6a87d59137bff02 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.mjs:17

        return this._client.get(path `/organization/projects/${projectID}/hosted_tool_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ab6f17c513e52240 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.mjs:34

        return this._client.post(path `/organization/projects/${projectID}/hosted_tool_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #462aacca20679022 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.js:20

        return this._client.get((0, path_1.path) `/organization/projects/${projectID}/model_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1d3a830b0aa335c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.js:38

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/model_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c5cfc481b2e8974b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.mjs:17

        return this._client.get(path `/organization/projects/${projectID}/model_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #336f49a5da93763e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.mjs:35

        return this._client.post(path `/organization/projects/${projectID}/model_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6663cc84e48826ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:77

        return this._client.get((0, path_1.path) `/organization/projects/${projectID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5e5b4370195da6a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:94

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dbda6ab9798b8e4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:131

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/archive`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #315326c50339a647 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:73

        return this._client.get(path `/organization/projects/${projectID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c9087afd60fac3ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:90

        return this._client.post(path `/organization/projects/${projectID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9f05202f9186409d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:127

        return this._client.post(path `/organization/projects/${projectID}/archive`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #261e50b90cb03aab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/rate-limits.js:39

        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/rate_limits/${rateLimitID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dac647039e673e37 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/rate-limits.mjs:36

        return this._client.post(path `/organization/projects/${project_id}/rate_limits/${rateLimitID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b230f4e350c216f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:22

        return this._client.post((0, path_1.path) `/projects/${projectID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5e84d441fb327ce6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:42

        return this._client.get((0, path_1.path) `/projects/${project_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1165de0888c4d42f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:61

        return this._client.post((0, path_1.path) `/projects/${project_id}/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0b87ad16e121ddd6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:19

        return this._client.post(path `/projects/${projectID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #16c198d03618d31b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:39

        return this._client.get(path `/projects/${project_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #190309002fea5dfa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:58

        return this._client.post(path `/projects/${project_id}/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #765a1b815610289b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/api-keys.js:22

        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/service_accounts/${serviceAccountID}/api_keys`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5132a1a02459dee1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/api-keys.mjs:19

        return this._client.post(path `/organization/projects/${project_id}/service_accounts/${serviceAccountID}/api_keys`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #31fdbde32c0e2b9b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:30

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/service_accounts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5e34ea992ec6cabb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:50

        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #15c8b6b7e8b85558 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:69

        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f4b5891008672879 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:26

        return this._client.post(path `/organization/projects/${projectID}/service_accounts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2b6e60219a07d3ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:46

        return this._client.get(path `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #027e8eded9b5aeec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:65

        return this._client.post(path `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9f6bfaac247d0c42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:30

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/spend_alerts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #378474db0822e8d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:50

        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a73717095f37d47a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:78

        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1b32196fdc44a411 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:27

        return this._client.post(path `/organization/projects/${projectID}/spend_alerts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #58b9e14ea913b7d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:47

        return this._client.get(path `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ddef40cd81d6390c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:75

        return this._client.post(path `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c56ce87189779dac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.js:23

        return this._client.post((0, path_1.path) `/projects/${project_id}/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #db5a24843fef6bab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.js:43

        return this._client.get((0, path_1.path) `/projects/${project_id}/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #47c7678fa7854bf9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.mjs:20

        return this._client.post(path `/projects/${project_id}/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #94c9f66393e1b7a7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.mjs:40

        return this._client.get(path `/projects/${project_id}/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #529d4fb2c4c0ebfc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:30

        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fc9ff8f4a3e88edf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:50

        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #67301994070251e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:69

        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ca22b88ae32f86b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:26

        return this._client.post(path `/organization/projects/${projectID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8a98e9172111133d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:46

        return this._client.get(path `/organization/projects/${project_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3eab85ac51b13e82 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:65

        return this._client.post(path `/organization/projects/${project_id}/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d1f09cda3d5551e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/roles.js:38

        return this._client.get((0, path_1.path) `/organization/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #806da92d6493ce02 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/roles.js:54

        return this._client.post((0, path_1.path) `/organization/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f0f4005a8f954825 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/roles.mjs:35

        return this._client.get(path `/organization/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6aef685d99cd6cd4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/roles.mjs:51

        return this._client.post(path `/organization/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #59221c84d51d2ba7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.js:45

        return this._client.get((0, path_1.path) `/organization/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ed73fc600b52dcff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.js:71

        return this._client.post((0, path_1.path) `/organization/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7cff23ddd4954a42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.mjs:42

        return this._client.get(path `/organization/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f7dd387e6cca6fc6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.mjs:68

        return this._client.post(path `/organization/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #98cad86888ec16b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/roles.js:22

        return this._client.post((0, path_1.path) `/organization/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bddbc575250cb1ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/roles.js:42

        return this._client.get((0, path_1.path) `/organization/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8f54a7b57a940166 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/roles.mjs:19

        return this._client.post(path `/organization/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f8cc5741f95e04d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/roles.mjs:39

        return this._client.get(path `/organization/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d06a0ce0663c7b14 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/users.js:26

        return this._client.get((0, path_1.path) `/organization/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9e54f9f39e820dee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/users.js:41

        return this._client.post((0, path_1.path) `/organization/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a32cff7b83a88b60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/users.mjs:22

        return this._client.get(path `/organization/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #242577821d9940fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/admin/organization/users/users.mjs:37

        return this._client.post(path `/organization/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1e71f93edc3a60c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/batches.js:22

        return this._client.get((0, path_1.path) `/batches/${batchID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1562356e76faf075 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/batches.js:40

        return this._client.post((0, path_1.path) `/batches/${batchID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #832864af96bc8f22 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/batches.mjs:19

        return this._client.get(path `/batches/${batchID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f0622f181355d2b2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/batches.mjs:37

        return this._client.post(path `/batches/${batchID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d7d4cf08bff21c0e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/assistants.js:32

        return this._client.get((0, path_1.path) `/assistants/${assistantID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #68d95f0b3dc61ffe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/assistants.js:44

        return this._client.post((0, path_1.path) `/assistants/${assistantID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #446cc18a9fe6d7fe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/assistants.mjs:29

        return this._client.get(path `/assistants/${assistantID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #08f8e082f068b8ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/assistants.mjs:41

        return this._client.post(path `/assistants/${assistantID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #609e18b1ea7f4ef0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/chatkit/sessions.js:41

        return this._client.post((0, path_1.path) `/chatkit/sessions/${sessionID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9a7d9548f417e716 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/chatkit/sessions.mjs:38

        return this._client.post(path `/chatkit/sessions/${sessionID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #60bf630443804732 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/chatkit/threads.js:20

        return this._client.get((0, path_1.path) `/chatkit/threads/${threadID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #134ff8382185d16f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/chatkit/threads.mjs:17

        return this._client.get(path `/chatkit/threads/${threadID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e956c2197a329b4b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/responses/responses.js:34

        return this._client.get((0, path_1.path) `/responses/${responseID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            stream: params?.stream ?? false,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c58febcae4c4bfc4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/responses/responses.js:80

        return this._client.post((0, path_1.path) `/responses/${responseID}/cancel?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4e49216e7322bf97 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/responses/responses.mjs:30

        return this._client.get(path `/responses/${responseID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            stream: params?.stream ?? false,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3bafef3e3d809788 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/responses/responses.mjs:76

        return this._client.post(path `/responses/${responseID}/cancel?beta=true`, {
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b9d69eab165d4b00 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/messages.js:21

        return this._client.post((0, path_1.path) `/threads/${threadID}/messages`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #10a7ff512fc17a26 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/messages.js:35

        return this._client.get((0, path_1.path) `/threads/${thread_id}/messages/${messageID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d4a2ddf6b8a8d022 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/messages.js:48

        return this._client.post((0, path_1.path) `/threads/${thread_id}/messages/${messageID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dba90e7519178dc9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:18

        return this._client.post(path `/threads/${threadID}/messages`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6ac9d0dedd5e63b0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:32

        return this._client.get(path `/threads/${thread_id}/messages/${messageID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ab70206299f38b4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:45

        return this._client.post(path `/threads/${thread_id}/messages/${messageID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #52b987845f98e8c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:26

        return this._client.post((0, path_1.path) `/threads/${threadID}/runs`, {
            query: { include },
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #39325742c5771a53 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:43

        return this._client.get((0, path_1.path) `/threads/${thread_id}/runs/${runID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f524ab628d6a566f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:56

        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #916a9782db68d856 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:83

        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #58a85e91ac741a6e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:163

        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8ae8417348adbe08 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:22

        return this._client.post(path `/threads/${threadID}/runs`, {
            query: { include },
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d499cd0a00f8ae31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:39

        return this._client.get(path `/threads/${thread_id}/runs/${runID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bfb1be32b3a1245e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:52

        return this._client.post(path `/threads/${thread_id}/runs/${runID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #22e3efc5076ff2d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:79

        return this._client.post(path `/threads/${thread_id}/runs/${runID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a9432a6af96b9366 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:159

        return this._client.post(path `/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c63590866de44c1c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/steps.js:22

        return this._client.get((0, path_1.path) `/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ba6637f7b44e220e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/runs/steps.mjs:19

        return this._client.get(path `/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
            query,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #afed69d25456cba5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/threads.js:44

        return this._client.get((0, path_1.path) `/threads/${threadID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3ca48a92c19a45c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/threads.js:56

        return this._client.post((0, path_1.path) `/threads/${threadID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #829e924607c1ab07 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:40

        return this._client.get(path `/threads/${threadID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2010944726795c43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:52

        return this._client.post(path `/threads/${threadID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #47fbabb7f37e4e47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/chat/completions/completions.js:42

        return this._client.get((0, path_1.path) `/chat/completions/${completionID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #13becb32d94dbf25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/chat/completions/completions.js:61

        return this._client.post((0, path_1.path) `/chat/completions/${completionID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #436337ef7d9bcbc4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:38

        return this._client.get(path `/chat/completions/${completionID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #41ce429938764c51 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:57

        return this._client.post(path `/chat/completions/${completionID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f82144ac99d467c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/containers.js:27

        return this._client.get((0, path_1.path) `/containers/${containerID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7951c92be69e0186 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/containers.mjs:23

        return this._client.get(path `/containers/${containerID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6e91f5e31d55b18e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/files/content.js:14

        return this._client.get((0, path_1.path) `/containers/${container_id}/files/${fileID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f9c197257f3a3f50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/files/content.mjs:11

        return this._client.get(path `/containers/${container_id}/files/${fileID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #daba6784e31f7d6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/files/files.js:25

        return this._client.post((0, path_1.path) `/containers/${containerID}/files`, (0, uploads_1.maybeMultipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #730d9aecb6605d9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/files/files.js:32

        return this._client.get((0, path_1.path) `/containers/${container_id}/files/${fileID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #eb04436765253e8a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/files/files.mjs:21

        return this._client.post(path `/containers/${containerID}/files`, maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5284cb8a1e30ef6d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/containers/files/files.mjs:28

        return this._client.get(path `/containers/${container_id}/files/${fileID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #05c1cdda3e04459f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/conversations.js:28

        return this._client.get((0, path_1.path) `/conversations/${conversationID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5472f7fdc83e7f47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/conversations.js:37

        return this._client.post((0, path_1.path) `/conversations/${conversationID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4900775822684cf8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/conversations.mjs:24

        return this._client.get(path `/conversations/${conversationID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #13cd8dc98159349b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/conversations.mjs:33

        return this._client.post(path `/conversations/${conversationID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #93f8c8dba555ac29 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/items.js:17

        return this._client.post((0, path_1.path) `/conversations/${conversationID}/items`, {
            query: { include },
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bfa9307dfee7a904 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/items.js:29

        return this._client.get((0, path_1.path) `/conversations/${conversation_id}/items/${itemID}`, {
            query,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #795b0b15f757a642 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/items.mjs:14

        return this._client.post(path `/conversations/${conversationID}/items`, {
            query: { include },
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2e6647fcee00046d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/conversations/items.mjs:26

        return this._client.get(path `/conversations/${conversation_id}/items/${itemID}`, {
            query,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #5c6f1fc2eb2d3f8a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/evals.js:34

        return this._client.get((0, path_1.path) `/evals/${evalID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #6ea2aab6ad479290 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/evals.js:40

        return this._client.post((0, path_1.path) `/evals/${evalID}`, { body, ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #2a1abf8336af1498 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/evals.mjs:30

        return this._client.get(path `/evals/${evalID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #f30a1df7b0f6a25e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/evals.mjs:36

        return this._client.post(path `/evals/${evalID}`, { body, ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #72f696b7fa0e8a37 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/output-items.js:17

        return this._client.get((0, path_1.path) `/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #054ed83b9407709e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/output-items.mjs:14

        return this._client.get(path `/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #00f0fef2ee9f4da9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/runs.js:25

        return this._client.post((0, path_1.path) `/evals/${evalID}/runs`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #647d3ae146dceb71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/runs.js:36

        return this._client.get((0, path_1.path) `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #297a3436bc8953a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/runs.js:66

        return this._client.post((0, path_1.path) `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #59bb750a3222cadb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:21

        return this._client.post(path `/evals/${evalID}/runs`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #7f2e4b9865d3b7dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:32

        return this._client.get(path `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #3828ad5e1e52f832 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:62

        return this._client.post(path `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b86c04b754acbb32 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/files.js:52

        return this._client.get((0, path_1.path) `/files/${fileID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bdfef265988a9de5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/files.js:74

        return this._client.get((0, path_1.path) `/files/${fileID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9fe993382246acda — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/files.mjs:49

        return this._client.get(path `/files/${fileID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #18907e1ea505eb6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/files.mjs:71

        return this._client.get(path `/files/${fileID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c0ed938a0ddf6827 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.js:41

        return this._client.get((0, path_1.path) `/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4e5290bb767cf24a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.mjs:38

        return this._client.get(path `/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1b500bc2dadf29ed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:52

        return this._client.get((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b1f6d2bd6078a789 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:86

        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1048b9e5d78a79db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:118

        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/pause`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0053b37eea1c4f62 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:134

        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/resume`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a77c4873b8edc823 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:48

        return this._client.get(path `/fine_tuning/jobs/${fineTuningJobID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #269bdc91d0b988c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:82

        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #71e85918c508c304 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:114

        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/pause`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2fdb4ca62ecc2d5b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:130

        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/resume`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f83dd62dee4593c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/models.js:17

        return this._client.get((0, path_1.path) `/models/${model}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5f2449d6b535e0a4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/models.mjs:14

        return this._client.get(path `/models/${model}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c7f00ea4c012914b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.js:21

        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/accept`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c8a46d87c5b6690d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.js:37

        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/hangup`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bee7bd5062af498e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.js:54

        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/refer`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #64ff377cf23bff2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.js:70

        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/reject`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ca4389ef2b019e66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.mjs:18

        return this._client.post(path `/realtime/calls/${callID}/accept`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5d41c4f00aede030 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.mjs:34

        return this._client.post(path `/realtime/calls/${callID}/hangup`, {
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9e54167ab10d9318 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.mjs:51

        return this._client.post(path `/realtime/calls/${callID}/refer`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bde4c259d9818738 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/realtime/calls.mjs:67

        return this._client.post(path `/realtime/calls/${callID}/reject`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #83225efb7aeb0abb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/responses/responses.js:35

        return this._client.get((0, path_1.path) `/responses/${responseID}`, {
            query,
            ...options,
            stream: query?.stream ?? false,
            __security: { bearerAuth: true },
        })._thenUnwrap((rsp) => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f4473cdb834a9083 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/responses/responses.js:88

        return this._client.post((0, path_1.path) `/responses/${responseID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f8b8f28308cc0829 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/responses/responses.mjs:31

        return this._client.get(path `/responses/${responseID}`, {
            query,
            ...options,
            stream: query?.stream ?? false,
            __security: { bearerAuth: true },
        })._thenUnwrap((rsp) => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8f502a736926c706 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/responses/responses.mjs:84

        return this._client.post(path `/responses/${responseID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e92f514a23a84f11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/content.js:13

        return this._client.get((0, path_1.path) `/skills/${skillID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6a9f438aec0a1a17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/content.mjs:10

        return this._client.get(path `/skills/${skillID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d9efbdb4b2367881 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/skills.js:30

        return this._client.get((0, path_1.path) `/skills/${skillID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c9ede6e41aa317f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/skills.js:36

        return this._client.post((0, path_1.path) `/skills/${skillID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c8745ac2a0b55b93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/skills.mjs:26

        return this._client.get(path `/skills/${skillID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b0ebd2034dfbc088 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/skills.mjs:32

        return this._client.post(path `/skills/${skillID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a68ae6b458bcb39c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/versions/content.js:14

        return this._client.get((0, path_1.path) `/skills/${skill_id}/versions/${version}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0e780fedd8a5e4b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/versions/content.mjs:11

        return this._client.get(path `/skills/${skill_id}/versions/${version}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #29bf6ef56d0be6b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/versions/versions.js:21

        return this._client.post((0, path_1.path) `/skills/${skillID}/versions`, (0, uploads_1.maybeMultipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ea727c398883d626 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/versions/versions.js:28

        return this._client.get((0, path_1.path) `/skills/${skill_id}/versions/${version}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #327ad0274e196aa0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/versions/versions.mjs:17

        return this._client.post(path `/skills/${skillID}/versions`, maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a2f0e01b369f6b06 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/skills/versions/versions.mjs:24

        return this._client.get(path `/skills/${skill_id}/versions/${version}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #23364a0d50f80537 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/uploads/parts.js:26

        return this._client.post((0, path_1.path) `/uploads/${uploadID}/parts`, (0, uploads_1.multipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0aed3ea64c939bbf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/uploads/parts.mjs:23

        return this._client.post(path `/uploads/${uploadID}/parts`, multipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8a5e5c5f5a20a8a9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/uploads/uploads.js:50

        return this._client.post((0, path_1.path) `/uploads/${uploadID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f9e0c2de94ee494c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/uploads/uploads.js:73

        return this._client.post((0, path_1.path) `/uploads/${uploadID}/complete`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #207c6bbfbed27cc4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/uploads/uploads.mjs:46

        return this._client.post(path `/uploads/${uploadID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b4f331f233af04f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/uploads/uploads.mjs:69

        return this._client.post(path `/uploads/${uploadID}/complete`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4eeb52b7b4344ae5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:16

        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}/file_batches`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #409c5dad136faf31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:28

        return this._client.get((0, path_1.path) `/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d2a273de505521aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:40

        return this._client.post((0, path_1.path) `/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #62cd61b61510f34e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:13

        return this._client.post(path `/vector_stores/${vectorStoreID}/file_batches`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #65ab11b465f024e2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:25

        return this._client.get(path `/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #98f2acd4c46483a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:37

        return this._client.post(path `/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0faea9a382076c1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/files.js:17

        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}/files`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e3f4312cc31fb56d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/files.js:29

        return this._client.get((0, path_1.path) `/vector_stores/${vector_store_id}/files/${fileID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d5216994b6d6f3fc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/files.js:40

        return this._client.post((0, path_1.path) `/vector_stores/${vector_store_id}/files/${fileID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c0c2239d30cefc70 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/files.mjs:14

        return this._client.post(path `/vector_stores/${vectorStoreID}/files`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #33a8292f02b4e9cf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/files.mjs:26

        return this._client.get(path `/vector_stores/${vector_store_id}/files/${fileID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #61575e222d8bbd09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/files.mjs:37

        return this._client.post(path `/vector_stores/${vector_store_id}/files/${fileID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a39615a8bcd680b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:35

        return this._client.get((0, path_1.path) `/vector_stores/${vectorStoreID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #05bdb3b768195b5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:45

        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7c2edfbe3b074c10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:31

        return this._client.get(path `/vector_stores/${vectorStoreID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6963106c93bdbc4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:41

        return this._client.post(path `/vector_stores/${vectorStoreID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c883532bc4afa2dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.js:21

        return this._client.get((0, path_1.path) `/videos/${videoID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aae98dd98a7734e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.js:51

        return this._client.get((0, path_1.path) `/videos/${videoID}/content`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3ff0260987e4fb81 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.js:76

        return this._client.get((0, path_1.path) `/videos/characters/${characterID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #59e01bb5d6dc500d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.js:85

        return this._client.post((0, path_1.path) `/videos/${videoID}/remix`, (0, uploads_1.maybeMultipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #08a931db0ef2ee2d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.mjs:18

        return this._client.get(path `/videos/${videoID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0cc404c991b919da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.mjs:48

        return this._client.get(path `/videos/${videoID}/content`, {
            query,
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #21925578ebe89d4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.mjs:73

        return this._client.get(path `/videos/characters/${characterID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8dca1b70725801ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/resources/videos.mjs:82

        return this._client.post(path `/videos/${videoID}/remix`, maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #edc42e5d70edb707 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:81

      const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #40a7a53ca4510f3d — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:145

      const url = new URL(
        `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`,
      );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #c43e5bde942de5e9 — Environment-variable access.

pkgs/npm/[email protected]/src/azure.ts:101

        endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #61dbf76e0008400b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/admin-api-keys.ts:41

    return this._client.get(path`/organization/admin_api_keys/${keyID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d7f95d1eae013d06 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/certificates.ts:55

    return this._client.get(path`/organization/certificates/${certificateID}`, {
      query,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ea1584be08ad6e86 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/certificates.ts:78

    return this._client.post(path`/organization/certificates/${certificateID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #40a8db699aae9fdc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/groups/groups.ts:69

    return this._client.get(path`/organization/groups/${groupID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d6cbb28d74a31d20 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/groups/groups.ts:91

    return this._client.post(path`/organization/groups/${groupID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ed9239f315c6979d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/groups/roles.ts:24

    return this._client.post(path`/organization/groups/${groupID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #11d1dee76beee73a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/groups/roles.ts:49

    return this._client.get(path`/organization/groups/${group_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2ba58718fbf7de89 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/groups/users.ts:23

    return this._client.post(path`/organization/groups/${groupID}/users`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2e1bf900818585d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/groups/users.ts:48

    return this._client.get(path`/organization/groups/${group_id}/users/${userID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cc69d50ead5c4f6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/invites.ts:47

    return this._client.get(path`/organization/invites/${inviteID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c4951d8d999c3b4b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/api-keys.ts:32

    return this._client.get(path`/organization/projects/${project_id}/api_keys/${apiKeyID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0674c9c998a25fc2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/data-retention.ts:21

    return this._client.get(path`/organization/projects/${projectID}/data_retention`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ab4aea4b493f2090 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/data-retention.ts:44

    return this._client.post(path`/organization/projects/${projectID}/data_retention`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #53c6eeb6186ce841 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/groups.ts:38

    return this._client.post(path`/organization/projects/${projectID}/groups`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #89395067e4603aaa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/groups.ts:59

    return this._client.get(path`/organization/projects/${project_id}/groups/${groupID}`, {
      query,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #acf7b65b9e155ef3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/roles.ts:29

    return this._client.post(path`/projects/${project_id}/groups/${groupID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6b3cd7b69261c05f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/roles.ts:54

    return this._client.get(path`/projects/${project_id}/groups/${group_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #209f50d1d18e618d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/hosted-tool-permissions.ts:21

    return this._client.get(path`/organization/projects/${projectID}/hosted_tool_permissions`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f3fc9052149c38ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/hosted-tool-permissions.ts:43

    return this._client.post(path`/organization/projects/${projectID}/hosted_tool_permissions`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #66c456d4762510fe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/model-permissions.ts:21

    return this._client.get(path`/organization/projects/${projectID}/model_permissions`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e7484274d6be8ad8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/model-permissions.ts:44

    return this._client.post(path`/organization/projects/${projectID}/model_permissions`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7e9c5ad88ce75847 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:165

    return this._client.get(path`/organization/projects/${projectID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4b6f030c4131b947 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:183

    return this._client.post(path`/organization/projects/${projectID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6f707d1bee3e5992 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:225

    return this._client.post(path`/organization/projects/${projectID}/archive`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4c98de0764216095 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/rate-limits.ts:57

    return this._client.post(path`/organization/projects/${project_id}/rate_limits/${rateLimitID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8474412831e6b1b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:25

    return this._client.post(path`/projects/${projectID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ae1e30499e235b09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:46

    return this._client.get(path`/projects/${project_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ea4acbc9b220c39c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:66

    return this._client.post(path`/projects/${project_id}/roles/${roleID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #865c4e8cfe557202 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/api-keys.ts:27

    return this._client.post(
      path`/organization/projects/${project_id}/service_accounts/${serviceAccountID}/api_keys`,
      { body, ...options, __security: { adminAPIKeyAuth: true } },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c41ca09a1f13d0d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:36

    return this._client.post(path`/organization/projects/${projectID}/service_accounts`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8ad93aff94d9a078 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:61

    return this._client.get(path`/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fb6c5e2824bf2bff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:85

    return this._client.post(
      path`/organization/projects/${project_id}/service_accounts/${serviceAccountID}`,
      { body, ...options, __security: { adminAPIKeyAuth: true } },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6995aaee8a1addb9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:39

    return this._client.post(path`/organization/projects/${projectID}/spend_alerts`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #95f8d91831d9e1f1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:64

    return this._client.get(path`/organization/projects/${project_id}/spend_alerts/${alertID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8fd642e51e8564e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:97

    return this._client.post(path`/organization/projects/${project_id}/spend_alerts/${alertID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ee4786eec3a0c97d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/roles.ts:26

    return this._client.post(path`/projects/${project_id}/users/${userID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fd55c408611984df — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/roles.ts:51

    return this._client.get(path`/projects/${project_id}/users/${user_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f70f82dce90488ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:43

    return this._client.post(path`/organization/projects/${projectID}/users`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8c08230a4838779e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:64

    return this._client.get(path`/organization/projects/${project_id}/users/${userID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8e221e36d9bd993d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:84

    return this._client.post(path`/organization/projects/${project_id}/users/${userID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #09f8abd81764602a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/roles.ts:40

    return this._client.get(path`/organization/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #746e6f8e7aa37691 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/roles.ts:57

    return this._client.post(path`/organization/roles/${roleID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fe6a4f08287bd0f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/spend-alerts.ts:51

    return this._client.get(path`/organization/spend_alerts/${alertID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #77de1d79e16689b2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/spend-alerts.ts:82

    return this._client.post(path`/organization/spend_alerts/${alertID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #06ac172355d5a917 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/users/roles.ts:25

    return this._client.post(path`/organization/users/${userID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a0454b0e706bd970 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/users/roles.ts:50

    return this._client.get(path`/organization/users/${user_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c2799d57ff8449b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/users/users.ts:39

    return this._client.get(path`/organization/users/${userID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #99a99dd145d45df0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/admin/organization/users/users.ts:55

    return this._client.post(path`/organization/users/${userID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1f4ebc3161aaceb5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/batches.ts:26

    return this._client.get(path`/batches/${batchID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f4e6bd66b01dc54c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/batches.ts:49

    return this._client.post(path`/batches/${batchID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ebd4bf5ce4bd39bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/assistants.ts:40

    return this._client.get(path`/assistants/${assistantID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2b5b63696d703b43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/assistants.ts:53

    return this._client.post(path`/assistants/${assistantID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ce42a103b693282e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/chatkit/sessions.ts:44

    return this._client.post(path`/chatkit/sessions/${sessionID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3e7161c24e8d69a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/chatkit/threads.ts:26

    return this._client.get(path`/chatkit/threads/${threadID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c833f69d97dd4898 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/responses/responses.ts:95

    return this._client.get(path`/responses/${responseID}?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
      stream: params?.stream ?? false,
      __security: { bearerAuth: true },
    }) as APIPromise<BetaResponse> | APIPromise<Stream<BetaResponseStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #57ea50f34c70a228 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/responses/responses.ts:151

    return this._client.post(path`/responses/${responseID}/cancel?beta=true`, {
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0883a03fda16c0aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:24

    return this._client.post(path`/threads/${threadID}/messages`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #df9402a4c254e785 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:39

    return this._client.get(path`/threads/${thread_id}/messages/${messageID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #438cdd7eae46925e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:53

    return this._client.post(path`/threads/${thread_id}/messages/${messageID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d4e712caa32f8c8b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:74

    return this._client.post(path`/threads/${threadID}/runs`, {
      query: { include },
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      stream: params.stream ?? false,
      __synthesizeEventData: true,
      __security: { bearerAuth: true },
    }) as APIPromise<Run> | APIPromise<Stream<AssistantsAPI.AssistantStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #adeebbdaadc0d6ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:92

    return this._client.get(path`/threads/${thread_id}/runs/${runID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ab0ec30d390857d9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:106

    return this._client.post(path`/threads/${thread_id}/runs/${runID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8bd24f5d1cb2fca5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:139

    return this._client.post(path`/threads/${thread_id}/runs/${runID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #368690789d3369d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:265

    return this._client.post(path`/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      stream: params.stream ?? false,
      __synthesizeEventData: true,
      __security: { bearerAuth: true },
    }) as APIPromise<Run> | APIPromise<Stream<AssistantsAPI.AssistantStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #434136896ebc3923 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/runs/steps.ts:25

    return this._client.get(path`/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
      query,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #da3963164437a4d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:104

    return this._client.get(path`/threads/${threadID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #08066e962442ae1e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:117

    return this._client.post(path`/threads/${threadID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #34029da4e1d6c499 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:100

    return this._client.get(path`/chat/completions/${completionID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ada3a6a22e901c6e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:124

    return this._client.post(path`/chat/completions/${completionID}`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bff5b639a8b2da3d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/containers/containers.ts:37

    return this._client.get(path`/containers/${containerID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1a31d51f1cad7fc0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/containers/files/content.ts:15

    return this._client.get(path`/containers/${container_id}/files/${fileID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4c768e8de0fefd94 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/containers/files/files.ts:28

    return this._client.post(
      path`/containers/${containerID}/files`,
      maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dccb7ac9bee2d94a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/containers/files/files.ts:43

    return this._client.get(path`/containers/${container_id}/files/${fileID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3ba2b573cd85eb84 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:41

    return this._client.get(path`/conversations/${conversationID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f51410a9482b9cbc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:55

    return this._client.post(path`/conversations/${conversationID}`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1ac26a17dc52c764 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/conversations/items.ts:28

    return this._client.post(path`/conversations/${conversationID}/items`, {
      query: { include },
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5b07a558b0bd13a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/conversations/items.ts:45

    return this._client.get(path`/conversations/${conversation_id}/items/${itemID}`, {
      query,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #4f5eb4bf85351fcb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/evals/evals.ts:52

    return this._client.get(path`/evals/${evalID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #b30322abea926b66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/evals/evals.ts:59

    return this._client.post(path`/evals/${evalID}`, { body, ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #88fce1207e6cc5ae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/evals/runs/output-items.ts:23

    return this._client.get(path`/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #3aef7d25a689e336 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:34

    return this._client.post(path`/evals/${evalID}/runs`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #1e110eb6e43ac56b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:50

    return this._client.get(path`/evals/${eval_id}/runs/${runID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #41795ac2a3a23d19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:87

    return this._client.post(path`/evals/${eval_id}/runs/${runID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dfc975e7d146ca3e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/files.ts:58

    return this._client.get(path`/files/${fileID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e51ab068e96d3621 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/files.ts:86

    return this._client.get(path`/files/${fileID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1cab5aac8da2b9cf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/fine-tuning/checkpoints/permissions.ts:60

    return this._client.get(path`/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
      query,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #866f73cbd41109a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:58

    return this._client.get(path`/fine_tuning/jobs/${fineTuningJobID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0d80e3089f8e3d14 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:97

    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #324bce09a0847c6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:139

    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/pause`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f6087cac4a736060 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:156

    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/resume`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f0182e1f6fe2c428 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/models.ts:18

    return this._client.get(path`/models/${model}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #452bedd95ba398ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/realtime/calls.ts:24

    return this._client.post(path`/realtime/calls/${callID}/accept`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3124ce22bb903036 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/realtime/calls.ts:41

    return this._client.post(path`/realtime/calls/${callID}/hangup`, {
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2d1ce264f4d63e9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/realtime/calls.ts:59

    return this._client.post(path`/realtime/calls/${callID}/refer`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c1de4404eb811d0c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/realtime/calls.ts:80

    return this._client.post(path`/realtime/calls/${callID}/reject`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #65e1c0181717bb0c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/responses/responses.ts:158

      this._client.get(path`/responses/${responseID}`, {
        query,
        ...options,
        stream: query?.stream ?? false,
        __security: { bearerAuth: true },
      }) as APIPromise<Response> | APIPromise<Stream<ResponseStreamEvent>>

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a3838b950cad6bc4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/responses/responses.ts:223

    return this._client.post(path`/responses/${responseID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cf3a4d62430bae71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/skills/content.ts:14

    return this._client.get(path`/skills/${skillID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #51e2ef18a3c32d23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/skills/skills.ts:43

    return this._client.get(path`/skills/${skillID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3e07d16f33f2868e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/skills/skills.ts:50

    return this._client.post(path`/skills/${skillID}`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #65cce52a6e917e4e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/skills/versions/content.ts:15

    return this._client.get(path`/skills/${skill_id}/versions/${version}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9581babff0cfa16d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/skills/versions/versions.ts:24

    return this._client.post(
      path`/skills/${skillID}/versions`,
      maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #50240b8758442d58 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/skills/versions/versions.ts:39

    return this._client.get(path`/skills/${skill_id}/versions/${version}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e6ec572eb2732b0c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/uploads/parts.ts:28

    return this._client.post(
      path`/uploads/${uploadID}/parts`,
      multipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3e9dc8b0f902fc83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:50

    return this._client.post(path`/uploads/${uploadID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #33a9d413960ca9d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:74

    return this._client.post(path`/uploads/${uploadID}/complete`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #55861520728ca7b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:25

    return this._client.post(path`/vector_stores/${vectorStoreID}/file_batches`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #55b06c697cfea596 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:42

    return this._client.get(path`/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5ce1f281d32dc800 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:59

    return this._client.post(path`/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6096126c7d0ed0e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:24

    return this._client.post(path`/vector_stores/${vectorStoreID}/files`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5320c5e65fac62ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:41

    return this._client.get(path`/vector_stores/${vector_store_id}/files/${fileID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #240ca9fd951502bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:53

    return this._client.post(path`/vector_stores/${vector_store_id}/files/${fileID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f646cfcf5191264f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:55

    return this._client.get(path`/vector_stores/${vectorStoreID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #74a3d54e758f2c64 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:70

    return this._client.post(path`/vector_stores/${vectorStoreID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2a8ae67f5b6488c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/videos.ts:27

    return this._client.get(path`/videos/${videoID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d7572c2de416b1fe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/videos.ts:74

    return this._client.get(path`/videos/${videoID}/content`, {
      query,
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8511208c02bc1fb9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/videos.ts:108

    return this._client.get(path`/videos/characters/${characterID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #599bd57ef6ba7f1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/resources/videos.ts:118

    return this._client.post(
      path`/videos/${videoID}/remix`,
      maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pg

npm dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #737ec18db8ef91a9 — Environment-variable access.

pkgs/npm/[email protected]/lib/connection-parameters.js:15

    envVar = process.env['PG' + key.toUpperCase()]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6243078468a5d486 — Environment-variable access.

pkgs/npm/[email protected]/lib/connection-parameters.js:19

    envVar = process.env[envVar]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4b31c9bfd8320cd — Environment-variable access.

pkgs/npm/[email protected]/lib/connection-parameters.js:26

  switch (process.env.PGSSLMODE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35d770d203509bce — Environment-variable access.

pkgs/npm/[email protected]/lib/connection-parameters.js:127

      this.connect_timeout = process.env.PGCONNECT_TIMEOUT || 0

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61c41af38fdaa198 — Environment-variable access.

pkgs/npm/[email protected]/lib/defaults.js:5

  user = process.platform === 'win32' ? process.env.USERNAME : process.env.USER

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d204c4d7a4ac3bba — Environment-variable access.

pkgs/npm/[email protected]/lib/index.js:41

  forceNative = !!process.env.NODE_PG_FORCE_NATIVE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

postgres

npm dependency

expand_more 8 low-confidence finding(s)

low env_fs dependency Excluded from app score #2596b312751126d0 — Filesystem access.

pkgs/npm/[email protected]/cf/src/index.js:133

        fs.readFile(path, 'utf8', (err, string) => {
          if (err)
            return query.reject(err)

          query.strings = [string]
          handler(query)
        })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d31c45b5ac0b256 — Environment-variable access.

pkgs/npm/[email protected]/cf/src/index.js:566

    return process.env.USERNAME || process.env.USER || process.env.LOGNAME  // eslint-disable-line

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef8e34745eb16ccb — Filesystem access.

pkgs/npm/[email protected]/cjs/src/index.js:2

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac3415abcdfe1de7 — Filesystem access.

pkgs/npm/[email protected]/cjs/src/index.js:132

        fs.readFile(path, 'utf8', (err, string) => {
          if (err)
            return query.reject(err)

          query.strings = [string]
          handler(query)
        })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dcf1987c2f196d45 — Environment-variable access.

pkgs/npm/[email protected]/cjs/src/index.js:565

    return process.env.USERNAME || process.env.USER || process.env.LOGNAME  // eslint-disable-line

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f79c98c9da957956 — Filesystem access.

pkgs/npm/[email protected]/src/index.js:2

import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f38bd5593c88e0b6 — Filesystem access.

pkgs/npm/[email protected]/src/index.js:132

        fs.readFile(path, 'utf8', (err, string) => {
          if (err)
            return query.reject(err)

          query.strings = [string]
          handler(query)
        })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #019906a801910318 — Environment-variable access.

pkgs/npm/[email protected]/src/index.js:565

    return process.env.USERNAME || process.env.USER || process.env.LOGNAME  // eslint-disable-line

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redis

npm dependency

expand_more 46 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #7e7c460df283a96e — Filesystem access.

pkgs/npm/[email protected]__reposrc/benchmark/lib/runner.js:84

await fs.writeFile(`${path}.json`, JSON.stringify(json));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #2366e2e96cf9baad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/benchmark/lib/set-get-delete-string/ioredis.js:15

                client.get(randomString),

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unknown #b6109f7ca92fba21 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/benchmark/lib/set-get-delete-string/v4.js:16

                client.get(randomString),

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #f0b03eac972be1fe — Filesystem access.

pkgs/npm/[email protected]__reposrc/doctests/query-agg.js:28

const bicycles = JSON.parse(fs.readFileSync('data/query_em.json', 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe306443681b6bc9 — Filesystem access.

pkgs/npm/[email protected]__reposrc/doctests/query-combined.js:66

const bicycles = JSON.parse(fs.readFileSync('data/query_vector.json', 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cff8b92ba4c135b2 — Filesystem access.

pkgs/npm/[email protected]__reposrc/doctests/query-em.js:31

const bicycles = JSON.parse(fs.readFileSync('data/query_em.json', 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53a927eb6ce63a8e — Filesystem access.

pkgs/npm/[email protected]__reposrc/doctests/query-ft.js:31

const bicycles = JSON.parse(fs.readFileSync('data/query_em.json', 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b4cd8c0ac634dca — Filesystem access.

pkgs/npm/[email protected]__reposrc/doctests/query-geo.js:28

const bicycles = JSON.parse(fs.readFileSync('data/query_em.json', 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8340d7225cd8bacb — Filesystem access.

pkgs/npm/[email protected]__reposrc/doctests/query-range.js:31

const bicycles = JSON.parse(fs.readFileSync('data/query_em.json', 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d138e881261d9e9a — Filesystem access.

pkgs/npm/[email protected]__reposrc/doctests/query-vector.js:54

const bicycles = JSON.parse(fs.readFileSync('data/query_vector.json', 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f20205da6d40bef — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/client/lib/client/enterprise-maintenance-manager.ts:60

  if (!process.env.REDIS_DEBUG_MAINTENANCE) return;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f8842bb7bfd5aa6 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/client/lib/client/enterprise-maintenance-manager.ts:65

  if (!process.env.REDIS_EMIT_DIAGNOSTICS) return;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1285e754989ed63e — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:98

      AZURE_CLIENT_ID: process.env.AZURE_CLIENT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #48f63b4f0adc7133 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:99

      AZURE_CLIENT_SECRET: process.env.AZURE_CLIENT_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5b804b2576e04004 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:100

      AZURE_AUTHORITY: process.env.AZURE_AUTHORITY,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #f03b137b3f27ee44 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:101

      AZURE_TENANT_ID: process.env.AZURE_TENANT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4c82a4ab5722cb73 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:102

      AZURE_REDIS_SCOPES: process.env.AZURE_REDIS_SCOPES,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #de40b56d7bbf1571 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:103

      AZURE_CERT: process.env.AZURE_CERT,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #82e07f314d0d1769 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:104

      AZURE_PRIVATE_KEY: process.env.AZURE_PRIVATE_KEY,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #77ffcf07f2dff4e8 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:105

      AZURE_USER_ASSIGNED_MANAGED_ID: process.env.AZURE_USER_ASSIGNED_MANAGED_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4e9f732b05e4444d — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:106

      REDIS_ENDPOINTS_CONFIG_PATH: process.env.REDIS_ENDPOINTS_CONFIG_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unknown #fe59e049f4234af7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/packages/entraid/integration-tests/entraid-integration.spec.ts:154

      const value = await client.get(key);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #882e811baf4852bc — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:8

if (!process.env.SESSION_SECRET) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f18305eb34370c8e — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:27

  secret: process.env.SESSION_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b03c7e60638c0e19 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:31

    secure: process.env.NODE_ENV === 'production', // Only use secure in production

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd8e0f3d0ec47a27 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:40

if (!process.env.MSAL_CLIENT_ID || !process.env.MSAL_TENANT_ID) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a5fbce68811468c — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:50

  clientId: process.env.MSAL_CLIENT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c8382e6d0eff452 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:51

  redirectUri: process.env.REDIRECT_URI || 'http://localhost:3000/redirect',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e94d840f1cc96cb2 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:52

  authorityConfig: { type: 'multi-tenant', tenantId: process.env.MSAL_TENANT_ID },

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04f05ca0d8ac2ce7 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/auth-code-pkce/index.ts:149

const PORT = process.env.PORT || 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86b7518bd8a69d10 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/interactive-browser/index.ts:9

if (!process.env.SESSION_SECRET) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46a71f5b3d4d2e83 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/interactive-browser/index.ts:16

  secret: process.env.SESSION_SECRET,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e63167ded9adafa — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/interactive-browser/index.ts:20

    secure: process.env.NODE_ENV === 'production', // Only use secure in production

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c33423b145d88352 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/interactive-browser/index.ts:29

if (!process.env.MSAL_CLIENT_ID || !process.env.MSAL_TENANT_ID) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #039d6051dc54a2f9 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/interactive-browser/index.ts:38

      clientId: process.env.MSAL_CLIENT_ID!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3548192cd8fa1fea — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/interactive-browser/index.ts:39

      tenantId: process.env.MSAL_TENANT_ID!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b4fe57b79345b46 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/entraid/samples/interactive-browser/index.ts:107

const PORT = process.env.PORT || 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a52fd67ebeb8113c — Filesystem access.

pkgs/npm/[email protected]__reposrc/packages/test-utils/lib/cae-client-testing.ts:22

    const configFile = await readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d1a0b38047c67f2d — Filesystem access.

pkgs/npm/[email protected]__reposrc/packages/test-utils/lib/dockers.ts:731

  fs.writeFile(`${dir}/redis.conf`, sentinelConfig, err => {
    if (err) {
      console.error("failed to create temporary config file", err);
    }
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65d8cf27c42049dc — Environment-variable access.

pkgs/npm/[email protected]__reposrc/packages/test-utils/lib/index.ts:958

        const baseUrl = process.env.RE_FAULT_INJECTOR_URL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #e2aee86d1661f47e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/packages/test-utils/lib/proxy/proxy-controller.ts:29

    return fetch(`${this.url}${path}`, options).then(res => res.json());

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2597c560bd0b8f5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]__reposrc/packages/test-utils/lib/proxy/redis-proxy-spec.ts:66

      const retrievedValue = await proxyClient.get(testKey);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unknown #c5a6f668ccd3dcff — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/check-command-jsdoc.ts:31

  const text = await fs.readFile(filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #796e5ab764e882ec — Environment-variable access.

pkgs/npm/[email protected]__reposrc/scripts/lint-changed.mjs:54

  const eventPath = process.env.GITHUB_EVENT_PATH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a6c5b225726b29ce — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/lint-changed.mjs:60

  return JSON.parse(readFileSync(eventPath, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #30718a66b261e6bd — Environment-variable access.

pkgs/npm/[email protected]__reposrc/scripts/lint-changed.mjs:114

  if (process.env.GITHUB_EVENT_NAME === 'pull_request') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

typeorm

npm dependency

expand_more 30 low-confidence finding(s)

low egress dependency Excluded from app score #89fd9a313cffaef3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/browser/cache/RedisQueryResultCache.js:94

        const result = await this.client.get(key);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8080939c559665b6 — Environment-variable access.

pkgs/npm/[email protected]/browser/cli-ts-node-esm.js:5

if ((process.env["NODE_OPTIONS"] ?? "").includes("--loader ts-node"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #70ac365cfae52a6b — Environment-variable access.

pkgs/npm/[email protected]/browser/cli-ts-node-esm.js:13

                process.env["NODE_OPTIONS"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b5de2cd35ef0a89 — Environment-variable access.

pkgs/npm/[email protected]/browser/driver/oracle/OracleDriver.js:221

            process.env.ORA_SDTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0bb20f63bd70cda — Environment-variable access.

pkgs/npm/[email protected]/browser/driver/postgres/PostgresDriver.js:273

            process.env.PGTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a914aa722813ac5 — Filesystem access.

pkgs/npm/[email protected]/browser/driver/sqljs/SqljsDriver.js:66

                    const database = PlatformTools_1.PlatformTools.readFileSync(fileNameOrLocalStorageOrData);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7ea09eb3feb8ae5 — Filesystem access.

pkgs/npm/[email protected]/browser/driver/sqljs/SqljsDriver.js:135

                await PlatformTools_1.PlatformTools.writeFile(path, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #020bda924ec2b118 — Filesystem access.

pkgs/npm/[email protected]/browser/platform/PlatformTools.d.ts:3

export { ReadStream } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #007c10bb0bbced8b — Filesystem access.

pkgs/npm/[email protected]/browser/platform/PlatformTools.js:8

const fs_1 = tslib_1.__importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e45b4d38a5459f06 — Filesystem access.

pkgs/npm/[email protected]/browser/platform/PlatformTools.js:13

var fs_2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee7f93fad6bbb9a4 — Filesystem access.

pkgs/npm/[email protected]/browser/platform/PlatformTools.js:137

        return fs_1.default.readFileSync(filename);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24ca54c95a2b36a9 — Filesystem access.

pkgs/npm/[email protected]/browser/platform/PlatformTools.js:143

        return fs_1.default.promises.writeFile(path, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c64ea78d735780a — Filesystem access.

pkgs/npm/[email protected]/browser/util/ImportUtils.js:88

                const parsedPackage = JSON.parse(await promises_1.default.readFile(potentialPackageJson, "utf8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #9e03f1855984c9e2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/cache/RedisQueryResultCache.js:94

        const result = await this.client.get(key);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #911d5fc4e9c14b70 — Environment-variable access.

pkgs/npm/[email protected]/cli-ts-node-esm.js:5

if ((process.env["NODE_OPTIONS"] ?? "").includes("--loader ts-node"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3ea67c26ccd129e — Environment-variable access.

pkgs/npm/[email protected]/cli-ts-node-esm.js:13

                process.env["NODE_OPTIONS"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29167e7ddcfcda60 — Filesystem access.

pkgs/npm/[email protected]/commands/CommandUtils.js:71

        await promises_1.default.writeFile(filePath, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0d1881eff24e89a — Filesystem access.

pkgs/npm/[email protected]/commands/CommandUtils.js:79

        const file = await promises_1.default.readFile(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e299209c93c8b155 — Filesystem access.

pkgs/npm/[email protected]/commands/InitCommand.js:79

            const packageJsonContents = await CommandUtils_1.CommandUtils.readFile(basePath + "/package.json");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e23c705326301c6b — Filesystem access.

pkgs/npm/[email protected]/commands/InitCommand.js:597

        const ourPackageJson = JSON.parse(await CommandUtils_1.CommandUtils.readFile(node_path_1.default.resolve(__dirname, "..", "package.json")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #205cc3c4824374e5 — Environment-variable access.

pkgs/npm/[email protected]/driver/oracle/OracleDriver.js:221

            process.env.ORA_SDTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f9f04e6eb47331b — Environment-variable access.

pkgs/npm/[email protected]/driver/postgres/PostgresDriver.js:273

            process.env.PGTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31e010eeacd77b86 — Filesystem access.

pkgs/npm/[email protected]/driver/sqljs/SqljsDriver.js:66

                    const database = PlatformTools_1.PlatformTools.readFileSync(fileNameOrLocalStorageOrData);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c91cc69494a666bd — Filesystem access.

pkgs/npm/[email protected]/driver/sqljs/SqljsDriver.js:135

                await PlatformTools_1.PlatformTools.writeFile(path, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb164a54a5676d19 — Filesystem access.

pkgs/npm/[email protected]/platform/PlatformTools.d.ts:3

export { ReadStream } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44133db098c4cdf6 — Filesystem access.

pkgs/npm/[email protected]/platform/PlatformTools.js:8

const fs_1 = tslib_1.__importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54ce657c370e2001 — Filesystem access.

pkgs/npm/[email protected]/platform/PlatformTools.js:13

var fs_2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d917a178d8b6f6e1 — Filesystem access.

pkgs/npm/[email protected]/platform/PlatformTools.js:137

        return fs_1.default.readFileSync(filename);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #01e5c5790cf51845 — Filesystem access.

pkgs/npm/[email protected]/platform/PlatformTools.js:143

        return fs_1.default.promises.writeFile(path, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aae1a5fc8cb788ec — Filesystem access.

pkgs/npm/[email protected]/util/ImportUtils.js:88

                const parsedPackage = JSON.parse(await promises_1.default.readFile(potentialPackageJson, "utf8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

undici

npm dependency

expand_more 13 low-confidence finding(s)

low env_fs dependency Excluded from app score #c19dc308480f82e3 — Environment-variable access.

pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:68

  const llhttpWasmData = process.env.JEST_WORKER_ID ? require('../llhttp/llhttp-wasm.js') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dcfb8ddb9c8604bb — Environment-variable access.

pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:75

  if (process.env.UNDICI_NO_WASM_SIMD === '1') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92be6eb443a10a4c — Environment-variable access.

pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:77

  } else if (process.env.UNDICI_NO_WASM_SIMD === '0') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #431cd2e801937f57 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/npm/[email protected]/lib/dispatcher/client-h2.js:851

    return session.request(headers, options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #0e1e734659344c24 — Environment-variable access.

pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:26

    const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6dcba5cafc3fb6f — Environment-variable access.

pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:33

    const HTTPS_PROXY = httpsProxy ?? process.env.https_proxy ?? process.env.HTTPS_PROXY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8faa0e405ce59207 — Environment-variable access.

pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:142

    return process.env.no_proxy ?? process.env.NO_PROXY ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13fa0e216230809c — Environment-variable access.

pkgs/npm/[email protected]/lib/mock/pending-interceptors-formatter.js:23

        colors: !disableColors && !process.env.CI

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03b18561ecc9ead8 — Filesystem access.

pkgs/npm/[email protected]/lib/mock/snapshot-recorder.js:424

      const data = await readFile(resolve(path), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56196ef16da71300 — Filesystem access.

pkgs/npm/[email protected]/lib/mock/snapshot-recorder.js:470

    await writeFile(resolvedPath, JSON.stringify(data, null, 2), { flush: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a378648f03488103 — Filesystem access.

pkgs/npm/[email protected]/scripts/strip-comments.js:7

  ? transcode(readFileSync('./undici-fetch.js'), 'utf8', 'latin1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1bdfc46ac5a2c487 — Filesystem access.

pkgs/npm/[email protected]/scripts/strip-comments.js:8

  : readFileSync('./undici-fetch.js')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #fbc7518291329968 — Filesystem access.

pkgs/npm/[email protected]/scripts/strip-comments.js:10

writeFileSync('./undici-fetch.js', buffer.toString('latin1'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

better-auth prod — dist-only: no readable source
openapi-types prod — dist-only: no readable source

verified_user No application data leak found

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz Application data flows

</> First-Party Code

first-party (npm)

</> Dependencies

hono

@google/genai

axios

@modelcontextprotocol/sdk

@types/adm-zip

adm-zip

better-sqlite3

dotenv

express

gpt-tokenizer

i18next-fs-backend

js-yaml

multer

openai

pg

postgres

redis

typeorm

undici

Skipped dependencies