Close Open Privacy Scan

link https://github.com/HKUDS/LightRAG
bolt Snapshot: commit fedd95c
science engine v3
schedule 2026-07-11T07:10:02.908050+00:00

verified_user Application data leak confirmed

High-confidence data exfiltration identified in application code.

App Privacy Score

37 /100
High privacy risk — application leak confirmed

High risk · 3727 finding(s)

Dependency score: 0 (High risk)

bar_chart Score Breakdown

pii_flow −60
env_fs −3

list Scan Summary

8 high 50 medium 3669 low
First-party packages: 1
Dependency packages: 59
Ecosystem: python

swap_horiz Confirmed data exfiltration in application code

External domains: 127.0.9.1:9api.cohere.comapi.deepseek.comapi.openai.comcloud.langfuse.comgo.devhuggingface.copypi.orgrequestb.inwrapdb.mesonbuild.comxkcd.com{FONT_LOC}

high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/lightrag/evaluation/eval_rag_quality.py:564 → repo/lightrag/evaluation/eval_rag_quality.py:597
high first-party (python) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/lightrag/evaluation/eval_rag_quality.py:564 → repo/lightrag/evaluation/eval_rag_quality.py:602
hub Dependency data flows (6)
high openai dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:239 → pkgs/python/[email protected]/src/openai/lib/azure.py:278
high openai dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:563 → pkgs/python/[email protected]/src/openai/lib/azure.py:602
high anthropic dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:384 → pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:384
high anthropic dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_workload.py:179 → pkgs/python/[email protected]/src/anthropic/lib/credentials/_workload.py:179
high lightrag-hku dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:564 → pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:597
high lightrag-hku dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:564 → pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:602

</> First-Party Code

first-party (python)

python first-party
high pii_flow production #f20e1c87f6bfea16 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/lightrag/evaluation/eval_rag_quality.py:597 · flow /tmp/closeopen-kpoboabw/repo/lightrag/evaluation/eval_rag_quality.py:564 → /tmp/closeopen-kpoboabw/repo/lightrag/evaluation/eval_rag_quality.py:597 
        limits = httpx.Limits(
            max_connections=(max_async + 1) * 2,  # Allow buffer for RAG stage
            max_keepalive_connections=max_async + 1,
        )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow production #c20251dfe9e0e39a — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
repo/lightrag/evaluation/eval_rag_quality.py:602 · flow /tmp/closeopen-kpoboabw/repo/lightrag/evaluation/eval_rag_quality.py:564 → /tmp/closeopen-kpoboabw/repo/lightrag/evaluation/eval_rag_quality.py:602 
        async with httpx.AsyncClient(timeout=timeout, limits=limits) as client:

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 612 low-confidence finding(s)
low env_fs production #31a50b4feaa64ae8 — Filesystem access.
repo/examples/generate_query.py:54 
    with open(file_path, "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b226c1b1ca159ebd — Filesystem access.
repo/examples/graph_visual_with_neo4j.py:85 
        with open(output_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b9604f8b645b86eb — Environment-variable access.
repo/examples/lightrag_ag2_multiagent_demo.py:115 
            "model": os.environ.get("OPENAI_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c55a3d29f33a589c — Environment-variable access.
repo/examples/lightrag_ag2_multiagent_demo.py:116 
            "api_key": os.environ["OPENAI_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a524b378e3c3383 — Environment-variable access.
repo/examples/lightrag_ag2_multiagent_demo.py:231 
                "model": os.environ.get("OPENAI_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da731c7ae8b8d9a7 — Environment-variable access.
repo/examples/lightrag_ag2_multiagent_demo.py:232 
                "api_key": os.environ["OPENAI_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d6226e4b39b01e1 — Environment-variable access.
repo/examples/lightrag_ag2_multiagent_demo.py:250 
    if not os.getenv("OPENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de33554bf2e64188 — Environment-variable access.
repo/examples/lightrag_azure_openai_demo.py:14 
AZURE_OPENAI_API_VERSION = os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #837645315e31eed4 — Environment-variable access.
repo/examples/lightrag_azure_openai_demo.py:15 
AZURE_OPENAI_DEPLOYMENT = os.getenv("AZURE_OPENAI_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #628417895ceadf0e — Environment-variable access.
repo/examples/lightrag_azure_openai_demo.py:16 
AZURE_OPENAI_API_KEY = os.getenv("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #898687945f1f667a — Environment-variable access.
repo/examples/lightrag_azure_openai_demo.py:17 
AZURE_OPENAI_ENDPOINT = os.getenv("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40a30cb5bb25db15 — Environment-variable access.
repo/examples/lightrag_azure_openai_demo.py:19 
AZURE_EMBEDDING_DEPLOYMENT = os.getenv("AZURE_EMBEDDING_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54a5c55851acadab — Environment-variable access.
repo/examples/lightrag_azure_openai_demo.py:20 
AZURE_EMBEDDING_API_VERSION = os.getenv("AZURE_EMBEDDING_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4ac18165191fd13 — Filesystem access.
repo/examples/lightrag_azure_openai_demo.py:104 
    book1 = open("./book_1.txt", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bbdfd4af20b784c1 — Filesystem access.
repo/examples/lightrag_azure_openai_demo.py:105 
    book2 = open("./book_2.txt", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e447711e7d32d901 — Environment-variable access.
repo/examples/lightrag_gemini_demo.py:33 
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f8bd16fe6cd17181 — Filesystem access.
repo/examples/lightrag_gemini_demo.py:103 
    with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8a93d063f193f35f — Environment-variable access.
repo/examples/lightrag_gemini_postgres_demo.py:60 
GEMINI_API_KEY = os.getenv("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e643292f6b9c4e06 — Filesystem access.
repo/examples/lightrag_gemini_postgres_demo.py:144 
        with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4d26823875c094cd — Environment-variable access.
repo/examples/lightrag_gemini_workspace_demo.py:41 
        api_key=os.getenv("GEMINI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5181179a7bb8a4a8 — Environment-variable access.
repo/examples/lightrag_gemini_workspace_demo.py:53 
        texts, api_key=os.getenv("GEMINI_API_KEY"), model="models/text-embedding-004"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc9875861880b738 — Filesystem access.
repo/examples/lightrag_gemini_workspace_demo.py:95 
            with open(book_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b27d2f0f50d8c0be — Filesystem access.
repo/examples/lightrag_gemini_workspace_demo.py:102 
            with open(hr_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cce24a8f289cb1d7 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:28 
    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e7b04839074597f1 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:35 
    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f87a32a54c766ced — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:36 
    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fdbffc93d7882334 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:78 
    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc11e5f9bc2136a9 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:89 
        llm_model_name=os.getenv("LLM_MODEL", "qwen2.5-coder:7b"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b0754b017f6ca46 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:92 
            "host": os.getenv("LLM_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #14f64c6f3aa6f20f — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:94 
            "timeout": int(os.getenv("TIMEOUT", "300")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39b63ad797890801 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:101 
            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0078457b13ab52d9 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:102 
            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "8192")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #830d91872678a6f9 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:105 
                embed_model=os.getenv("EMBEDDING_MODEL", "bge-m3:latest"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1ff82e4cde65030 — Environment-variable access.
repo/examples/lightrag_ollama_demo.py:106 
                host=os.getenv("EMBEDDING_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ba883f2f0118e8de — Filesystem access.
repo/examples/lightrag_ollama_demo.py:152 
        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e3a2fbe9174263e — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:29 
    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94e7d8d478da94fe — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:38 
    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12896c7b335143e7 — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:39 
    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af407e7a3d8a2e5a — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:81 
    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb8d4efd56564710 — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:92 
        os.getenv("LLM_MODEL", "deepseek-chat"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ff60d112f42d0130 — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:96 
        api_key=os.getenv("LLM_BINDING_API_KEY") or os.getenv("OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f6b2313661540a8f — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:97 
        base_url=os.getenv("LLM_BINDING_HOST", "https://api.deepseek.com"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d32f8c5a0b920564 — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:117 
            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9be26d0fbfba6b12 — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:118 
            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "8192")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #90ea1a41b2c60a9a — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:121 
                embed_model=os.getenv("EMBEDDING_MODEL", "bge-m3:latest"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca957642c62fb1a1 — Environment-variable access.
repo/examples/lightrag_openai_compatible_demo.py:122 
                host=os.getenv("EMBEDDING_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #252f8f0e5169de10 — Filesystem access.
repo/examples/lightrag_openai_compatible_demo.py:163 
        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ff02aee957ecf5f0 — Environment-variable access.
repo/examples/lightrag_openai_demo.py:22 
    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2771d369670bdc4b — Environment-variable access.
repo/examples/lightrag_openai_demo.py:29 
    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10368e0c59cd5b2e — Environment-variable access.
repo/examples/lightrag_openai_demo.py:30 
    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f584b21c74daa3f9 — Environment-variable access.
repo/examples/lightrag_openai_demo.py:72 
    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d74c55f93e9566c — Environment-variable access.
repo/examples/lightrag_openai_demo.py:93 
    if not os.getenv("OPENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bda0aeb3c209170f — Filesystem access.
repo/examples/lightrag_openai_demo.py:132 
        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #60ad3fc3edc33c78 — Environment-variable access.
repo/examples/lightrag_openai_mongodb_graph_demo.py:18 
os.environ["OPENAI_API_KEY"] = "sk-"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d21f01469fe06e32 — Environment-variable access.
repo/examples/lightrag_openai_mongodb_graph_demo.py:19 
os.environ["MONGO_URI"] = "mongodb://0.0.0.0:27017/?directConnection=true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2a6ea41e1e10cc69 — Environment-variable access.
repo/examples/lightrag_openai_mongodb_graph_demo.py:20 
os.environ["MONGO_DATABASE"] = "LightRAG"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ffb7dfe5b0f16f1b — Environment-variable access.
repo/examples/lightrag_openai_mongodb_graph_demo.py:21 
os.environ["MONGO_KG_COLLECTION"] = "MDB_KG"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #615d102171522521 — Environment-variable access.
repo/examples/lightrag_openai_mongodb_graph_demo.py:24 
EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4350d11aee185922 — Environment-variable access.
repo/examples/lightrag_openai_mongodb_graph_demo.py:25 
EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1b33bcf7ac27244 — Filesystem access.
repo/examples/lightrag_openai_mongodb_graph_demo.py:75 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9abd11bbbe5161b — Environment-variable access.
repo/examples/lightrag_openai_opensearch_graph_demo.py:56 
if not os.getenv("OPENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #117806a03d7de0c5 — Environment-variable access.
repo/examples/lightrag_openai_opensearch_graph_demo.py:57 
    os.environ["OPENAI_API_KEY"] = "sk-"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69699646e0474816 — Environment-variable access.
repo/examples/lightrag_openai_opensearch_graph_demo.py:59 
EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b23582b56b79ac40 — Environment-variable access.
repo/examples/lightrag_openai_opensearch_graph_demo.py:60 
EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f7028dd6cad80636 — Filesystem access.
repo/examples/lightrag_openai_opensearch_graph_demo.py:144 
        with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #879301162b89676f — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:60 
        model=os.getenv("LLM_MODEL", "Qwen/Qwen3-14B-AWQ"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9648ba04e2e11c3a — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:64 
        base_url=os.getenv("LLM_BINDING_HOST", "http://0.0.0.0:4646/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54cdff5b59e1794f — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:65 
        api_key=os.getenv("LLM_BINDING_API_KEY", "not_needed"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #826d5949d31ae314 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:76 
    model_name=os.getenv("EMBEDDING_MODEL", "Qwen/Qwen3-Embedding-0.6B"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1065927ff558bdec — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:78 
    embedding_dim=int(os.getenv("EMBEDDING_DIM", 1024)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6fa5dafec5affbe6 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:79 
    max_token_size=int(os.getenv("EMBEDDING_TOKEN_LIMIT", 4096)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a1b8c931bd6771be — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:82 
        model=os.getenv("EMBEDDING_MODEL", "Qwen/Qwen3-Embedding-0.6B"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #079449c1bd66ea04 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:83 
        base_url=os.getenv(
            "EMBEDDING_BINDING_HOST",
            "http://0.0.0.0:1234/v1",
        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9cee4218dbd5ded — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:87 
        api_key=os.getenv("EMBEDDING_BINDING_API_KEY", "not_needed"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fadb69d9f27c2bb5 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:97 
    model=os.getenv("RERANK_MODEL", "Qwen/Qwen3-Reranker-0.6B"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb591edff8e3f747 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:98 
    api_key=os.getenv("RERANK_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e384a129dd3163cd — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:99 
    base_url=os.getenv(
        "RERANK_BINDING_HOST",
        "http://0.0.0.0:3535/v1/rerank",
    ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af2f55f083571d63 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:117 
        kv_storage=os.getenv("KV_STORAGE", "PGKVStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f385652959e8c98 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:118 
        doc_status_storage=os.getenv("DOC_STATUS_STORAGE", "PGDocStatusStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #17142d501fd28708 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:119 
        vector_storage=os.getenv("VECTOR_STORAGE", "PGVectorStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #644db7d7be1af991 — Environment-variable access.
repo/examples/lightrag_vllm_demo.py:120 
        graph_storage=os.getenv("GRAPH_STORAGE", "Neo4JStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db3566c1c76b8784 — Filesystem access.
repo/examples/lightrag_vllm_demo.py:147 
        with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5474682010bc4439 — Environment-variable access.
repo/examples/milvus_kwargs_configuration_demo.py:20 
    os.environ["MILVUS_URI"] = "http://localhost:19530"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7bcc7af951a36fa3 — Environment-variable access.
repo/examples/rerank_example.py:51 
        os.getenv("LLM_MODEL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #091d86249a358113 — Environment-variable access.
repo/examples/rerank_example.py:55 
        api_key=os.getenv("LLM_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac90ca0f71b5502a — Environment-variable access.
repo/examples/rerank_example.py:56 
        base_url=os.getenv("LLM_BINDING_HOST"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #607e98bfb4029f0b — Environment-variable access.
repo/examples/rerank_example.py:64 
        model=os.getenv("EMBEDDING_MODEL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06af9dc76cb54c77 — Environment-variable access.
repo/examples/rerank_example.py:65 
        api_key=os.getenv("EMBEDDING_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36246cca1cf381e6 — Environment-variable access.
repo/examples/rerank_example.py:66 
        base_url=os.getenv("EMBEDDING_BINDING_HOST"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #95342649ac597966 — Environment-variable access.
repo/examples/rerank_example.py:72 
    model=os.getenv("RERANK_MODEL", "rerank-v3.5"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fd42166a5914d337 — Environment-variable access.
repo/examples/rerank_example.py:73 
    api_key=os.getenv("RERANK_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb55c531e56d26db — Environment-variable access.
repo/examples/rerank_example.py:74 
    base_url=os.getenv("RERANK_BINDING_HOST", "https://api.cohere.com/v2/rerank"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #31ff55fb0f92ae21 — Environment-variable access.
repo/examples/rerank_example.py:75 
    enable_chunking=os.getenv("RERANK_ENABLE_CHUNKING", "false").lower() == "true",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9e5980fd5a17f756 — Environment-variable access.
repo/examples/rerank_example.py:76 
    max_tokens_per_doc=int(os.getenv("RERANK_MAX_TOKENS_PER_DOC", "4096")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5365b21d723ccd1d — Environment-variable access.
repo/examples/unofficial-sample/copy_llm_cache_to_another_storage.py:17 
ROOT_DIR = os.environ.get("ROOT_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6512b476264c974 — Environment-variable access.
repo/examples/unofficial-sample/copy_llm_cache_to_another_storage.py:26 
os.environ["AGE_GRAPH_NAME"] = "chinese"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9685316d09951863 — Filesystem access.
repo/examples/unofficial-sample/lightrag_bedrock_demo.py:41 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45d497ef6613f7fc — Environment-variable access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:141 
    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d4ffebbea01e2eba — Environment-variable access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:150 
    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77aa6d5261b38c6b — Environment-variable access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:151 
    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e1960746080de30 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:193 
    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f1f2708e59c4eb39 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:212 
        llm_model_name=os.getenv("LLM_MODEL", LLM_MODEL),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7ef890b2e5bc46b4 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:215 
            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd8ae4df00c6b71a — Environment-variable access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:216 
            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "2048")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a8bcd18363097c14 — Filesystem access.
repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:266 
        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4c5e4f5bc944e68c — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:29 
    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c173e648c0322d6 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:38 
    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74667f86d9c18104 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:39 
    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed2350c45a8d9a71 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:81 
    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ff8f5d647609578e — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:92 
        os.getenv("LLM_MODEL", "deepseek-chat"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6acf977b41d283ca — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:96 
        api_key=os.getenv("LLM_BINDING_API_KEY") or os.getenv("OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad76dd3bde757aaa — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:97 
        base_url=os.getenv("LLM_BINDING_HOST", "https://api.deepseek.com"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #affc9b45f6d534fe — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:117 
            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7422ef637d03ce14 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:118 
            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "8192")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8efe909640e79dcd — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:122 
                embed_model=os.getenv("EMBEDDING_MODEL", "FRIDA:latest"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4754c29b16fa9a1 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:123 
                host=os.getenv("EMBEDDING_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b045fd2ee824e6e0 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:124 
                query_prefix=os.getenv("EMBEDDING_QUERY_PREFIX", "search_query: "),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #621a5bb7e777036f — Environment-variable access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:125 
                document_prefix=os.getenv(
                    "EMBEDDING_DOCUMENT_PREFIX", "search_document: "
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc2991b243c2e82f — Filesystem access.
repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:169 
        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bfc7977c177af8a0 — Filesystem access.
repo/examples/unofficial-sample/lightrag_hf_demo.py:46 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bdc43756efa93a2b — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:21 
LLM_MODEL = os.environ.get("LLM_MODEL", "gpt-4")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b43aceab3c25ffb1 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:23 
EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18c7714c2be6e973 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:25 
EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e11f5749f29af720 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:29 
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "your-api-key-here")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d196680e3fe42383 — Filesystem access.
repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:105 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b8c63d042494631 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:21 
LLM_MODEL = os.environ.get("LLM_MODEL", "gpt-4")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed762f47ab2fe266 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:23 
EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8c3c7574ea1a12c1 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:25 
EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ec1b791d0bdedb73 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:29 
LITELLM_URL = os.environ.get("LITELLM_URL", "http://localhost:4000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc558364a8bea5a0 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:31 
LITELLM_KEY = os.environ.get("LITELLM_KEY", "sk-1234")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19fe969a042dd02a — Filesystem access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:107 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d82721259bd5cb11 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:21 
LLM_MODEL = os.environ.get("LLM_MODEL", "gemma-3-4b")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #82b1ddb988fab5c2 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:23 
EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "arctic-embed")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6d138645a760155 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:25 
EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef484bc20704ad6a — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:29 
LITELLM_URL = os.environ.get("LITELLM_URL", "http://localhost:4000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ecbe8091d919348e — Environment-variable access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:31 
LITELLM_KEY = os.environ.get("LITELLM_KEY", "sk-4JdvGFKqSA3S0k_5p0xufw")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7cc50df311adc18b — Filesystem access.
repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:118 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ba7e270c55a31ef — Filesystem access.
repo/examples/unofficial-sample/lightrag_lmdeploy_demo.py:73 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #806874f3f12aa860 — Filesystem access.
repo/examples/unofficial-sample/lightrag_nvidia_demo.py:127 
        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a63f4c3d31455ee7 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:15 
os.environ["REDIS_URI"] = "redis://localhost:6379"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e96351dfa5d8db3 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:20 
os.environ["NEO4J_URI"] = "neo4j://localhost:7687"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c850813ee6c1f1e3 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:21 
os.environ["NEO4J_USERNAME"] = "neo4j"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4889cf41adf8032a — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:22 
os.environ["NEO4J_PASSWORD"] = "12345678"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #388045ac41dcfaca — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:25 
os.environ["MILVUS_URI"] = "http://localhost:19530"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a598ca364ab0d62 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:26 
os.environ["MILVUS_USER"] = "root"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1217291dd6cfef1a — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:27 
os.environ["MILVUS_PASSWORD"] = "Milvus"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a97510ea48f86e32 — Environment-variable access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:28 
os.environ["MILVUS_DB_NAME"] = "lightrag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a70ff4be373e6fd2 — Filesystem access.
repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:76 
    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c194f8e830e0711f — Environment-variable access.
repo/lightrag/api/config.py:73 
        "ollama": os.getenv("LLM_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #facc316e251b763c — Environment-variable access.
repo/lightrag/api/config.py:74 
        "lollms": os.getenv("LLM_BINDING_HOST", "http://localhost:9600"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f788b1430ae9977c — Environment-variable access.
repo/lightrag/api/config.py:75 
        "azure_openai": os.getenv("AZURE_OPENAI_ENDPOINT", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f45bb4b28a43279d — Environment-variable access.
repo/lightrag/api/config.py:76 
        "openai": os.getenv("LLM_BINDING_HOST", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4779a52d20a9a67b — Environment-variable access.
repo/lightrag/api/config.py:79 
        "bedrock": os.getenv("LLM_BINDING_HOST", "DEFAULT_BEDROCK_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64d65cf638090e5e — Environment-variable access.
repo/lightrag/api/config.py:82 
        "gemini": os.getenv("LLM_BINDING_HOST", "DEFAULT_GEMINI_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9e05da503c55e68 — Environment-variable access.
repo/lightrag/api/config.py:85 
        binding_type, os.getenv("LLM_BINDING_HOST", "http://localhost:11434")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a119bccbaafb2537 — Environment-variable access.
repo/lightrag/api/config.py:143 
    if env_key not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ba5c372d14bea308 — Environment-variable access.
repo/lightrag/api/config.py:146 
    value = os.environ[env_key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d869ca58be8d3bb — Environment-variable access.
repo/lightrag/api/config.py:176 
    bearer_token = os.getenv("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #879579811e39a008 — Environment-variable access.
repo/lightrag/api/config.py:733 
    args.embedding_asymmetric_configured = "EMBEDDING_ASYMMETRIC" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9742ce9d8ccbd484 — Environment-variable access.
repo/lightrag/api/gunicorn_config.py:14 
log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97a186c2a8f6d84d — Environment-variable access.
repo/lightrag/api/gunicorn_config.py:40 
errorlog = os.getenv("ERROR_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9fa28bc4222dda08 — Environment-variable access.
repo/lightrag/api/gunicorn_config.py:41 
accesslog = os.getenv("ACCESS_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8dbde555eb7fa8c6 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:82 
webui_title = os.getenv("WEBUI_TITLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d449462c1d9d258 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:83 
webui_description = os.getenv("WEBUI_DESCRIPTION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #852806317d32f9da — Environment-variable access.
repo/lightrag/api/lightrag_server.py:491 
    api_mode_raw = os.getenv("MINERU_API_MODE", "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3ab8b11ec64cf734 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:495 
        endpoint = os.getenv("MINERU_OFFICIAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72be38fccb2a435a — Environment-variable access.
repo/lightrag/api/lightrag_server.py:497 
        endpoint = os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69764305442f9ea8 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:524 
    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac060d819f13d8ba — Environment-variable access.
repo/lightrag/api/lightrag_server.py:532 
            "ocr_engine": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85ae31c555792472 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:533 
            "ocr_lang": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b3f1666f8b306d4c — Environment-variable access.
repo/lightrag/api/lightrag_server.py:1263 
    api_key = os.getenv("LIGHTRAG_API_KEY") or args.key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a64a28df4182843 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:1290 
            if "LIGHTRAG_GUNICORN_MODE" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #caffd47020f154ab — Environment-variable access.
repo/lightrag/api/lightrag_server.py:1517 
                api_key=os.getenv("AZURE_OPENAI_API_KEY", args.llm_binding_api_key),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e24c7993f5859b8b — Environment-variable access.
repo/lightrag/api/lightrag_server.py:1518 
                api_version=os.getenv("AZURE_OPENAI_API_VERSION", "2024-08-01-preview"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #960f39c38f86a505 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:1832 
                        api_key=role_apikey or os.getenv("AZURE_OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dfb892d0bbb113d1 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:1833 
                        api_version=os.getenv(
                            "AZURE_OPENAI_API_VERSION", "2024-08-01-preview"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed89f14675b9012d — Environment-variable access.
repo/lightrag/api/lightrag_server.py:1997 
                    os.getenv("RERANK_ENABLE_CHUNKING", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d20607d3ce342514 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:2000 
                    os.getenv("RERANK_MAX_TOKENS_PER_DOC", "4096")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #70b67c418a2711c8 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:2403 
                    if os.environ.get("LIGHTRAG_GUNICORN_MODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2b95a779b1d67f21 — Filesystem access.
repo/lightrag/api/lightrag_server.py:2496 
                content = Path(response.path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0da8204ac35d5d53 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:2566 
    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6af654ff79a3a660 — Environment-variable access.
repo/lightrag/api/lightrag_server.py:2671 
    if "GUNICORN_CMD_ARGS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37e528476604b02c — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:13 
_PROCESS_START_OBJC_FORK_SAFETY = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d7817123f64111f — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:76 
    os.environ["LIGHTRAG_GUNICORN_MODE"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d94a4f0d5c8ee3d1 — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:88 
        current_objc_fork_safety = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #35c620c1bae1e251 — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:206 
                else os.getenv("HOST", "0.0.0.0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3693f4fcc7512693 — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:219 
                else os.getenv("LOG_LEVEL", "info")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74997922629b1527 — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:235 
            if global_args.ssl or os.getenv("SSL", "").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9c563ff3ef78a666 — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:245 
                    else os.getenv("SSL_CERTFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3dc8c49a30899eaa — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:250 
                    else os.getenv("SSL_KEYFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #edf980f4ac7523f3 — Environment-variable access.
repo/lightrag/api/run_with_gunicorn.py:284 
        os.environ["LIGHTRAG_MAIN_PROCESS"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2204e97da50e76fe — Filesystem access.
repo/lightrag/api/runtime_validation.py:36 
            return Path(candidate).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f33d757760ac34da — Environment-variable access.
repo/lightrag/api/runtime_validation.py:47 
    environ = environ or os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c097080b61ddd9c6 — Environment-variable access.
repo/lightrag/base.py:41 
        self._lightrag_name = name or os.getenv(
            "OLLAMA_EMULATING_MODEL_NAME", DEFAULT_OLLAMA_MODEL_NAME
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #469e9e5b9209f944 — Environment-variable access.
repo/lightrag/base.py:44 
        self._lightrag_tag = tag or os.getenv(
            "OLLAMA_EMULATING_MODEL_TAG", DEFAULT_OLLAMA_MODEL_TAG
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e999d4098a5bf5b4 — Environment-variable access.
repo/lightrag/base.py:107 
    top_k: int = int(os.getenv("TOP_K", str(DEFAULT_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a5d52e4adf76285b — Environment-variable access.
repo/lightrag/base.py:110 
    chunk_top_k: int = int(os.getenv("CHUNK_TOP_K", str(DEFAULT_CHUNK_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e687f1cae46d7637 — Environment-variable access.
repo/lightrag/base.py:116 
        os.getenv("MAX_ENTITY_TOKENS", str(DEFAULT_MAX_ENTITY_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92c1d45cd2f58b46 — Environment-variable access.
repo/lightrag/base.py:121 
        os.getenv("MAX_RELATION_TOKENS", str(DEFAULT_MAX_RELATION_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #34da68c34000ea8b — Environment-variable access.
repo/lightrag/base.py:126 
        os.getenv("MAX_TOTAL_TOKENS", str(DEFAULT_MAX_TOTAL_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4989bc41e896d78e — Environment-variable access.
repo/lightrag/base.py:148 
    enable_rerank: bool = os.getenv("RERANK_BY_DEFAULT", "true").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #02e2484887d57db9 — Environment-variable access.
repo/lightrag/chunker/paragraph_semantic.py:217 
    raw = os.getenv("CHUNK_P_REFERENCES_TAIL_N")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ce73ede1189f810 — Environment-variable access.
repo/lightrag/chunker/paragraph_semantic.py:238 
    raw = os.getenv("CHUNK_P_REFERENCES_HEADINGS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d2301d4b231dc34 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:147 
        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #33087196307fc59a — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:147 
        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(
            "OPENAI_API_KEY"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12c01de59685273a — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:157 
        eval_model = os.getenv("EVAL_LLM_MODEL", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d75c51e955f5ee60 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:158 
        eval_llm_base_url = os.getenv("EVAL_LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #66718e17e127061f — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:163 
            os.getenv("EVAL_EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8a63d086e1744d65 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:164 
            or os.getenv("EVAL_LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d35b274e1e80cd5 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:165 
            or os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad53b9f327d1ca49 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:167 
        eval_embedding_model = os.getenv(
            "EVAL_EMBEDDING_MODEL", "text-embedding-3-large"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6957e9457435cf0f — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:171 
        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6542c507b448e1fe — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:171 
        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(
            "EVAL_LLM_BINDING_HOST"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #818a7e536f1c80a7 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:179 
            "max_retries": int(os.getenv("EVAL_LLM_MAX_RETRIES", "5")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #73376d5c884e442b — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:180 
            "request_timeout": int(os.getenv("EVAL_LLM_TIMEOUT", "180")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e854c7524321b4df — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:218 
            rag_api_url = os.getenv("LIGHTRAG_API_URL", "http://localhost:9621")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d2cc37c7b34f6a3d — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:269 
        query_top_k = int(os.getenv("EVAL_QUERY_TOP_K", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #57ef7606445c4e35 — Filesystem access.
repo/lightrag/evaluation/eval_rag_quality.py:285 
        with open(self.test_dataset_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e116a922ea35550e — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:316 
                "top_k": int(os.getenv("EVAL_QUERY_TOP_K", "10")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b5b08545b1f84f3 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:320 
            api_key = os.getenv("LIGHTRAG_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bfc319a9ca5ad809 — Environment-variable access.
repo/lightrag/evaluation/eval_rag_quality.py:564 
        max_async = int(os.getenv("EVAL_MAX_CONCURRENT", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6ad995c9de3b9d30 — Filesystem access.
repo/lightrag/evaluation/eval_rag_quality.py:647 
        with open(csv_path, "w", newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #123c9eeea9773803 — Filesystem access.
repo/lightrag/evaluation/eval_rag_quality.py:899 
        with open(json_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9ab010ca9a729387 — Filesystem access.
repo/lightrag/evaluation/offline_retrieval_check.py:84 
    payload = json.loads(dataset_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9bbdc5112812c798 — Filesystem access.
repo/lightrag/evaluation/offline_retrieval_check.py:92 
    payload = json.loads(oracle_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09862c3198dd37dd — Filesystem access.
repo/lightrag/evaluation/offline_retrieval_check.py:115 
                tokens=Counter(tokenize(path.read_text(encoding="utf-8"))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c37d02a46e7831d — Filesystem access.
repo/lightrag/kg/faiss_impl.py:820 
            with open(tmp, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6dc8d1bdf058a16e — Filesystem access.
repo/lightrag/kg/faiss_impl.py:853 
            with open(self._meta_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2542b7548772f32c — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:27 
MAX_GRAPH_NODES = int(os.getenv("MAX_GRAPH_NODES", 1000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eff0dd0ab9a992bd — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:38 
        memgraph_workspace = os.environ.get("MEMGRAPH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4ed62b833ff05e1 — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:78 
            URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #689367eb9a4301bd — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:78 
            URI = os.environ.get(
                "MEMGRAPH_URI",
                config.get("memgraph", "uri", fallback="bolt://localhost:7687"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6d910fb9a80fb6f4 — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:82 
            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5dc435b935051019 — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:82 
            USERNAME = os.environ.get(
                "MEMGRAPH_USERNAME", config.get("memgraph", "username", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5bc05a040bfa7dc9 — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:85 
            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ee12e0006234d72 — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:85 
            PASSWORD = os.environ.get(
                "MEMGRAPH_PASSWORD", config.get("memgraph", "password", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7d325cd3d92206a7 — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:88 
            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #589832884a9e5071 — Environment-variable access.
repo/lightrag/kg/memgraph_impl.py:88 
            DATABASE = os.environ.get(
                "MEMGRAPH_DATABASE",
                config.get("memgraph", "database", fallback="memgraph"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65fb2231b0832b43 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:159 
    val = os.environ.get(key, "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b61ff0fe28156c72 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:169 
    val = os.environ.get(key, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6767c0353c4adf7c — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:212 
            self.index_type or os.environ.get("MILVUS_INDEX_TYPE", "AUTOINDEX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2b43b272de2f81b5 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:217 
            self.metric_type or os.environ.get("MILVUS_METRIC_TYPE", "COSINE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e66fb161b80ef00f — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:231 
            self.sq_type = os.environ.get("MILVUS_HNSW_SQ_TYPE", "SQ8").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2cbcb673961c4a4 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:235 
            self.sq_refine_type = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ce21e197e7f145f2 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:235 
            self.sq_refine_type = os.environ.get(
                "MILVUS_HNSW_SQ_REFINE_TYPE", "FP32"
            ).upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4bbc5a2cbf33ead6 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:442 
            "uri": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d843f8689e36683 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:442 
            "uri": os.environ.get(
                "MILVUS_URI",
                config.get(
                    "milvus",
                    "uri",
                    fallback=os.path.join(
                        self.global_config["working_dir"], "milvus_lite.db"
                    ),
                ),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4d29caeebbd27868 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:452 
            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d83626edb714e309 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:452 
            "user": os.environ.get(
                "MILVUS_USER", config.get("milvus", "user", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5953e864c96c50bb — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:455 
            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #01572bb0184514e3 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:455 
            "password": os.environ.get(
                "MILVUS_PASSWORD",
                config.get("milvus", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #044cb3219c55ea49 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:459 
            "token": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dbeef7af381a9b2b — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:459 
            "token": os.environ.get(
                "MILVUS_TOKEN", config.get("milvus", "token", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c640649c63aa5b31 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:464 
        db_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eaf46dd361212a69 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:464 
        db_name = os.environ.get(
            "MILVUS_DB_NAME",
            config.get("milvus", "db_name", fallback=None),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1136d05ac21cf181 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:2092 
        milvus_workspace = os.environ.get("MILVUS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83a48912c387d6df — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:2144 
            os.getenv(
                "MILVUS_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_MILVUS_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5d8b0d2ed730c56b — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:2150 
            os.getenv(
                "MILVUS_UPSERT_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_UPSERT_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6f3c5d24f14f424a — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:2156 
            os.getenv(
                "MILVUS_DELETE_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_DELETE_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #287339de485a8e01 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:2183 
            os.getenv(
                "MILVUS_MIGRATION_RETRY_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a95bacca40c6a13 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:2189 
            os.getenv(
                "MILVUS_MIGRATION_RETRY_MAX_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_MAX_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #589e028cb22f53b8 — Environment-variable access.
repo/lightrag/kg/milvus_impl.py:2211 
                os.getenv(
                    "MILVUS_MIGRATION_BATCH_SLEEP",
                    str(DEFAULT_MILVUS_MIGRATION_BATCH_SLEEP_SECONDS),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65158ec1704ddeef — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:52 
GRAPH_BFS_MODE = os.getenv("MONGO_GRAPH_BFS_MODE", "bidirectional")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #03651cfdec3d77ec — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:190 
        os.getenv(
            "MONGO_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_MONGO_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2488e07249fcfca4 — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:196 
        os.getenv(
            "MONGO_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ecf8746b88ad94f8 — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:221 
        os.getenv(
            "MONGO_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eb69da4f00a38ece — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:287 
                uri = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d211bd89232b7d6 — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:287 
                uri = os.environ.get(
                    "MONGO_URI",
                    config.get(
                        "mongodb",
                        "uri",
                        fallback="mongodb://root:root@localhost:27017/",
                    ),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1617551210a05602 — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:295 
                database_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #894dbf9dee3f1449 — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:295 
                database_name = os.environ.get(
                    "MONGO_DATABASE",
                    config.get("mongodb", "database", fallback="LightRAG"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #28b6ffe90578570a — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:343 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc6294361b9cbc3e — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:592 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b5f070936783c1a — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:1106 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9be00c0abe4871d6 — Environment-variable access.
repo/lightrag/kg/mongo_impl.py:2886 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #752d3f0c56ef766b — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:81 
        neo4j_workspace = os.environ.get("NEO4J_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dab4842b0be54786 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:174 
            URI = os.environ.get("NEO4J_URI", config.get("neo4j", "uri", fallback=None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36fca66f2787cfb2 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:175 
            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb721a9efb4f7600 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:175 
            USERNAME = os.environ.get(
                "NEO4J_USERNAME", config.get("neo4j", "username", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bf170fd66da46b0d — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:178 
            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f4575a422573d9c6 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:178 
            PASSWORD = os.environ.get(
                "NEO4J_PASSWORD", config.get("neo4j", "password", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #010cf92fb79ee9d6 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:182 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cf8eb0f2181b855f — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:182 
                os.environ.get(
                    "NEO4J_MAX_CONNECTION_POOL_SIZE",
                    config.get("neo4j", "connection_pool_size", fallback=100),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d7b7090e48aed1e7 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:188 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a839101512d2b266 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:188 
                os.environ.get(
                    "NEO4J_CONNECTION_TIMEOUT",
                    config.get("neo4j", "connection_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #01781e3333de5965 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:194 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #560597ec4a014c94 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:194 
                os.environ.get(
                    "NEO4J_CONNECTION_ACQUISITION_TIMEOUT",
                    config.get(
                        "neo4j", "connection_acquisition_timeout", fallback=30.0
                    ),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c26701e89d0f85d — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:202 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4052c58d988bb09c — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:202 
                os.environ.get(
                    "NEO4J_MAX_TRANSACTION_RETRY_TIME",
                    config.get("neo4j", "max_transaction_retry_time", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #61876709ddf28550 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:208 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10b33074527ee959 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:208 
                os.environ.get(
                    "NEO4J_MAX_CONNECTION_LIFETIME",
                    config.get("neo4j", "max_connection_lifetime", fallback=300.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #669268871d7a40d0 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:214 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #28ae88e4ac42d49d — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:214 
                os.environ.get(
                    "NEO4J_LIVENESS_CHECK_TIMEOUT",
                    config.get("neo4j", "liveness_check_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74e16a3971533fde — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:219 
            KEEP_ALIVE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb37041bf9638692 — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:219 
            KEEP_ALIVE = os.environ.get(
                "NEO4J_KEEP_ALIVE",
                config.get("neo4j", "keep_alive", fallback="true"),
            ).lower() in ("true", "1", "yes", "on")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #95dde1ca7876707d — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:223 
            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79e077fb5fb48ded — Environment-variable access.
repo/lightrag/kg/neo4j_impl.py:223 
            DATABASE = os.environ.get(
                "NEO4J_DATABASE", re.sub(r"[^a-zA-Z0-9-]", "-", self.namespace)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3975f97e078b3e3b — Environment-variable access.
repo/lightrag/kg/opensearch_impl.py:60 
    return os.environ.get(key, config.get("opensearch", cfg_key, fallback=fallback))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb1f0d7c83251278 — Environment-variable access.
repo/lightrag/kg/opensearch_impl.py:524 
    opensearch_workspace = os.environ.get("OPENSEARCH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3c416c2ea21286d3 — Environment-variable access.
repo/lightrag/kg/opensearch_impl.py:1928 
        env_override = os.environ.get("OPENSEARCH_USE_PPL_GRAPHLOOKUP", "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f6c1e2471b8f5e78 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:184 
        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #957f85750b320090 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:184 
        os.environ.get(
            "POSTGRES_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_PG_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #63c68e61f5af48ca — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:190 
        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #385924974db3ad04 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:190 
        os.environ.get(
            "POSTGRES_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f78bcca16c5e5eec — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:196 
        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fafaac19eba2f1ad — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:196 
        os.environ.get(
            "POSTGRES_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65a42007f2870278 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2314 
            "host": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #288c62320724e2ca — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2314 
            "host": os.environ.get(
                "POSTGRES_HOST",
                config.get("postgres", "host", fallback="localhost"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3456ba3d84c29eaf — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2318 
            "port": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d06035f6633c0b86 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2318 
            "port": os.environ.get(
                "POSTGRES_PORT", config.get("postgres", "port", fallback=5432)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #182ed9aa5a7c1dc2 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2321 
            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ccd164c51d51fc7 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2321 
            "user": os.environ.get(
                "POSTGRES_USER", config.get("postgres", "user", fallback="postgres")
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #56d8042318d11aca — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2324 
            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #715bffc08b05376c — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2324 
            "password": os.environ.get(
                "POSTGRES_PASSWORD",
                config.get("postgres", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #75d355b0e6a49fac — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2328 
            "database": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a2c77fe86d8db27f — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2328 
            "database": os.environ.get(
                "POSTGRES_DATABASE",
                config.get("postgres", "database", fallback="postgres"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #73054a4398e85a4d — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2332 
            "workspace": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f780a06e3156fa72 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2332 
            "workspace": os.environ.get(
                "POSTGRES_WORKSPACE",
                config.get("postgres", "workspace", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99510cfa53846949 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2336 
            "max_connections": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #26869a9e638f117a — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2336 
            "max_connections": os.environ.get(
                "POSTGRES_MAX_CONNECTIONS",
                config.get("postgres", "max_connections", fallback=50),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9fdf1f332cb687f — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2341 
            "ssl_mode": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c04467ec3b7d6a0 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2341 
            "ssl_mode": os.environ.get(
                "POSTGRES_SSL_MODE",
                config.get("postgres", "ssl_mode", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df7c6374fe90f34b — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2345 
            "ssl_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc037f3e6ec73fd9 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2345 
            "ssl_cert": os.environ.get(
                "POSTGRES_SSL_CERT",
                config.get("postgres", "ssl_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #db9dd798066471aa — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2349 
            "ssl_key": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7aa0050ced524355 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2349 
            "ssl_key": os.environ.get(
                "POSTGRES_SSL_KEY",
                config.get("postgres", "ssl_key", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a8befd7baa7e819 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2353 
            "ssl_root_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f238dd35e801edb — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2353 
            "ssl_root_cert": os.environ.get(
                "POSTGRES_SSL_ROOT_CERT",
                config.get("postgres", "ssl_root_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de576676c3a640c0 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2357 
            "ssl_crl": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5ae2168879743f62 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2357 
            "ssl_crl": os.environ.get(
                "POSTGRES_SSL_CRL",
                config.get("postgres", "ssl_crl", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bca4e1e6567c9692 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2366 
            "vector_index_type": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed5e15a1c8a03669 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2366 
            "vector_index_type": os.environ.get(
                "POSTGRES_VECTOR_INDEX_TYPE",
                config.get("postgres", "vector_index_type", fallback="HNSW"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ceaf2d526290f2a9 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2371 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dd1c9f9382648d53 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2371 
                os.environ.get(
                    "POSTGRES_HNSW_M",
                    config.get("postgres", "hnsw_m", fallback="16"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4b218c0e46c0de8 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2377 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e3d38415e87d0ed2 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2377 
                os.environ.get(
                    "POSTGRES_HNSW_EF",
                    config.get("postgres", "hnsw_ef", fallback="64"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ae513913d1f9d95 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2383 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dbcd48cdc26edccb — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2383 
                os.environ.get(
                    "POSTGRES_IVFFLAT_LISTS",
                    config.get("postgres", "ivfflat_lists", fallback="100"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8a91babe5a04bbe4 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2388 
            "vchordrq_build_options": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #75843ecfc71f99a2 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2388 
            "vchordrq_build_options": os.environ.get(
                "POSTGRES_VCHORDRQ_BUILD_OPTIONS",
                config.get("postgres", "vchordrq_build_options", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fca633f74b494158 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2392 
            "vchordrq_probes": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9546ee042773d4a — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2392 
            "vchordrq_probes": os.environ.get(
                "POSTGRES_VCHORDRQ_PROBES",
                config.get("postgres", "vchordrq_probes", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eff139ed997c72e8 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2397 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0e08db7a68f733f — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2397 
                os.environ.get(
                    "POSTGRES_VCHORDRQ_EPSILON",
                    config.get("postgres", "vchordrq_epsilon", fallback="1.9"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f699cf5d5a039eb — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2403 
            "server_settings": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09c76917124cdfa4 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2403 
            "server_settings": os.environ.get(
                "POSTGRES_SERVER_SETTINGS",
                config.get("postgres", "server_options", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2a7c6f55aa253be — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2407 
            "statement_cache_size": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e58da9ed554a1027 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2407 
            "statement_cache_size": os.environ.get(
                "POSTGRES_STATEMENT_CACHE_SIZE",
                config.get("postgres", "statement_cache_size", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2a028676d9a02b89 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2415 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0aca55648ea626f1 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2415 
                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRIES",
                        config.get("postgres", "connection_retries", fallback=10),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cfd04436e6840ccb — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2424 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6208b9fe184a8229 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2424 
                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF",
                        config.get(
                            "postgres", "connection_retry_backoff", fallback=3.0
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa3357de80422098 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2435 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4aa27bac27cf2ae5 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2435 
                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF_MAX",
                        config.get(
                            "postgres",
                            "connection_retry_backoff_max",
                            fallback=30.0,
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d84a98cb7ecf2b28 — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2448 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fdcb47fd662b36ac — Environment-variable access.
repo/lightrag/kg/postgres_impl.py:2448 
                    os.environ.get(
                        "POSTGRES_POOL_CLOSE_TIMEOUT",
                        config.get("postgres", "pool_close_timeout", fallback=5.0),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6ec9d8632217789e — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:475 
        qdrant_workspace = os.environ.get("QDRANT_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe3e0f92429fee93 — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:520 
            os.getenv(
                "QDRANT_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_QDRANT_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e5402ce4807d930a — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:526 
            os.getenv(
                "QDRANT_UPSERT_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_UPSERT_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #46d9dcb76f2a6eef — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:532 
            os.getenv(
                "QDRANT_DELETE_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_DELETE_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54dc193c84980350 — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:657 
                        url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #63601c19899ff97f — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:657 
                        url=os.environ.get(
                            "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #49b4c270a7f83092 — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:660 
                        api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4370715c136b2e10 — Environment-variable access.
repo/lightrag/kg/qdrant_impl.py:660 
                        api_key=os.environ.get(
                            "QDRANT_API_KEY",
                            config.get("qdrant", "apikey", fallback=None),
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8f555a3e6b22b32d — Environment-variable access.
repo/lightrag/kg/redis_impl.py:45 
MAX_CONNECTIONS = int(os.getenv("REDIS_MAX_CONNECTIONS", "200"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c125a33f5773c621 — Environment-variable access.
repo/lightrag/kg/redis_impl.py:46 
SOCKET_TIMEOUT = float(os.getenv("REDIS_SOCKET_TIMEOUT", "30.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0806a6ebc008bcd — Environment-variable access.
repo/lightrag/kg/redis_impl.py:47 
SOCKET_CONNECT_TIMEOUT = float(os.getenv("REDIS_CONNECT_TIMEOUT", "10.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a580766f8f8c690 — Environment-variable access.
repo/lightrag/kg/redis_impl.py:48 
RETRY_ATTEMPTS = int(os.getenv("REDIS_RETRY_ATTEMPTS", "3"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #67cda30df8626d21 — Environment-variable access.
repo/lightrag/kg/redis_impl.py:137 
        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2327abcbecd1c956 — Environment-variable access.
repo/lightrag/kg/redis_impl.py:165 
        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de5f828e79129ab3 — Environment-variable access.
repo/lightrag/kg/redis_impl.py:165 
        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3f1e8617a422a9bd — Environment-variable access.
repo/lightrag/kg/redis_impl.py:534 
        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0eee025ea20e5aa9 — Environment-variable access.
repo/lightrag/kg/redis_impl.py:564 
        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #752857c29bedc0ea — Environment-variable access.
repo/lightrag/kg/redis_impl.py:564 
        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6698c3b1dbdebb70 — Environment-variable access.
repo/lightrag/lightrag.py:290 
    workspace: str = field(default_factory=lambda: os.getenv("WORKSPACE", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d132cacadde842e — Environment-variable access.
repo/lightrag/lightrag.py:484 
    embedding_batch_num: int = field(default=int(os.getenv("EMBEDDING_BATCH_NUM", 10)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad3be33fb8531ab4 — Environment-variable access.
repo/lightrag/lightrag.py:488 
        default=int(os.getenv("EMBEDDING_FUNC_MAX_ASYNC", 8))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9015cf7ee9c5f23 — Environment-variable access.
repo/lightrag/lightrag.py:506 
        default=int(os.getenv("EMBEDDING_TIMEOUT", DEFAULT_EMBEDDING_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c0842950b46b3df7 — Environment-variable access.
repo/lightrag/lightrag.py:530 
        default=int(os.getenv("SUMMARY_MAX_TOKENS", DEFAULT_SUMMARY_MAX_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #472353b939418d88 — Environment-variable access.
repo/lightrag/lightrag.py:535 
        default=int(os.getenv("SUMMARY_CONTEXT_SIZE", DEFAULT_SUMMARY_CONTEXT_SIZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d50fe8f2dab0b695 — Environment-variable access.
repo/lightrag/lightrag.py:541 
            os.getenv("SUMMARY_LENGTH_RECOMMENDED", DEFAULT_SUMMARY_LENGTH_RECOMMENDED)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5d1f36ed48d7056c — Environment-variable access.
repo/lightrag/lightrag.py:548 
            os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ca7d2e44709134f — Environment-variable access.
repo/lightrag/lightrag.py:557 
        default=int(os.getenv("LLM_TIMEOUT", DEFAULT_LLM_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #780fdf310f499294 — Environment-variable access.
repo/lightrag/lightrag.py:561 
        default=os.getenv("ENTITY_EXTRACTION_USE_JSON", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #46ba8b515e78cdb3 — Environment-variable access.
repo/lightrag/lightrag.py:577 
            os.getenv(
                "MAX_ASYNC_RERANK",
                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bcea62df96d2066b — Environment-variable access.
repo/lightrag/lightrag.py:579 
                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb25fa3d2096f864 — Environment-variable access.
repo/lightrag/lightrag.py:588 
        default=int(os.getenv("RERANK_TIMEOUT", DEFAULT_RERANK_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5e2fc79299632f52 — Environment-variable access.
repo/lightrag/lightrag.py:625 
        default=int(os.getenv("MAX_PARALLEL_INSERT", DEFAULT_MAX_PARALLEL_INSERT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53086ece22ec7a00 — Environment-variable access.
repo/lightrag/lightrag.py:631 
            os.getenv(
                "MAX_PARALLEL_PARSE_NATIVE", str(DEFAULT_MAX_PARALLEL_PARSE_NATIVE)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b1a8f92e4d2a061 — Environment-variable access.
repo/lightrag/lightrag.py:638 
            os.getenv(
                "MAX_PARALLEL_PARSE_MINERU", str(DEFAULT_MAX_PARALLEL_PARSE_MINERU)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f70f5fb62846a08 — Environment-variable access.
repo/lightrag/lightrag.py:645 
            os.getenv(
                "MAX_PARALLEL_PARSE_DOCLING", str(DEFAULT_MAX_PARALLEL_PARSE_DOCLING)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a89a5045da5a78c9 — Environment-variable access.
repo/lightrag/lightrag.py:652 
            os.getenv("MAX_PARALLEL_ANALYZE", str(DEFAULT_MAX_PARALLEL_ANALYZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #876dced53a969182 — Environment-variable access.
repo/lightrag/lightrag.py:656 
        default=int(os.getenv("QUEUE_SIZE_PARSE", str(DEFAULT_QUEUE_SIZE_PARSE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3c2ecf8f336c1f57 — Environment-variable access.
repo/lightrag/lightrag.py:659 
        default=int(os.getenv("QUEUE_SIZE_ANALYZE", str(DEFAULT_QUEUE_SIZE_ANALYZE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40c3bb693c9b9702 — Environment-variable access.
repo/lightrag/lightrag.py:662 
        default=int(os.getenv("QUEUE_SIZE_INSERT", str(DEFAULT_QUEUE_SIZE_INSERT)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85ea45f7325f9a1f — Environment-variable access.
repo/lightrag/lightrag.py:736 
        default=float(os.getenv("COSINE_THRESHOLD", 0.2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36875bcce6276937 — Environment-variable access.
repo/lightrag/lightrag.py:818 
                chunker_cfg["chunk_token_size"] = int(os.getenv("CHUNK_SIZE", 1200))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #56838b1971cceb1d — Environment-variable access.
repo/lightrag/lightrag.py:826 
            legacy_overlap_default = int(os.getenv("CHUNK_OVERLAP_SIZE", 100))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74b55b2b3c755b9c — Environment-variable access.
repo/lightrag/lightrag.py:855 
        p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a737ea59f25bc6ad — Environment-variable access.
repo/lightrag/lightrag.py:877 
            size_raw = os.getenv(size_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #76d465476e6c1214 — Environment-variable access.
repo/lightrag/lightrag.py:969 
        if os.getenv("ENTITY_TYPES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cf53e3e9a77f90a9 — Filesystem access.
repo/lightrag/llm/_vision_utils.py:273 
        with open(path, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6ab37320df3d4081 — Environment-variable access.
repo/lightrag/llm/anthropic.py:78 
        api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c440fade92c4c3db — Environment-variable access.
repo/lightrag/llm/binding_options.py:379 
            env_raw = os.getenv(role_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a16a9ed04517a97b — Environment-variable access.
repo/lightrag/llm/binding_options.py:806 
        os.environ["OPENAI_LLM_REASONING"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c15155d19709de3b — Environment-variable access.
repo/lightrag/llm/binding_options.py:829 
            if "OPENAI_LLM_REASONING" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b518d9ef456e4c3f — Environment-variable access.
repo/lightrag/llm/binding_options.py:830 
                del os.environ["OPENAI_LLM_REASONING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #51d3ba0cdb0608e8 — Environment-variable access.
repo/lightrag/llm/gemini.py:98 
    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d96b98eb4f8d7e25 — Environment-variable access.
repo/lightrag/llm/gemini.py:102 
        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac6d8ed5e52808bc — Environment-variable access.
repo/lightrag/llm/gemini.py:104 
            location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8579f9ece0b39956 — Environment-variable access.
repo/lightrag/llm/gemini.py:134 
    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09c2e06ed5e6bc09 — Environment-variable access.
repo/lightrag/llm/gemini.py:139 
    key = api_key or os.getenv("LLM_BINDING_API_KEY") or os.getenv("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a01768b612356e64 — Environment-variable access.
repo/lightrag/llm/hf.py:32 
os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6e40de16ef6b1c55 — Environment-variable access.
repo/lightrag/llm/jina.py:120 
        os.environ["JINA_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #11098ae6ba175ef1 — Environment-variable access.
repo/lightrag/llm/jina.py:122 
    if "JINA_API_KEY" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cd5b23ef49c98bfe — Environment-variable access.
repo/lightrag/llm/jina.py:128 
        "Authorization": f"Bearer {os.environ['JINA_API_KEY']}",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #52cff33b1a88cc74 — Environment-variable access.
repo/lightrag/llm/nvidia_openai.py:57 
        os.environ["OPENAI_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #89e90d3b8b8dd3b9 — Environment-variable access.
repo/lightrag/llm/ollama.py:147 
        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6e254fd4627f432 — Environment-variable access.
repo/lightrag/llm/ollama.py:299 
        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #934895a14595a6ac — Environment-variable access.
repo/lightrag/llm/openai.py:48 
    langfuse_public_key = os.environ.get("LANGFUSE_PUBLIC_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dba349cf011695ea — Environment-variable access.
repo/lightrag/llm/openai.py:49 
    langfuse_secret_key = os.environ.get("LANGFUSE_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3fde6b359532dc16 — Environment-variable access.
repo/lightrag/llm/openai.py:110 
EMBEDDING_USE_BASE64: bool = os.getenv("EMBEDDING_USE_BASE64", "true").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3351ea9dc1695d2e — Environment-variable access.
repo/lightrag/llm/openai.py:166 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b553f1032a461507 — Environment-variable access.
repo/lightrag/llm/openai.py:166 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(
                "LLM_BINDING_API_KEY"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #377d2a179360e3cf — Environment-variable access.
repo/lightrag/llm/openai.py:192 
            api_key = os.environ["OPENAI_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c48ba454e9e70941 — Environment-variable access.
repo/lightrag/llm/openai.py:198 
        dashscope_workspace_id = os.getenv("DASHSCOPE_WORKSPACE_ID", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a3d5069f06c6395 — Environment-variable access.
repo/lightrag/llm/openai.py:215 
            merged_configs["base_url"] = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #864d4d620e792a67 — Environment-variable access.
repo/lightrag/llm/openai.py:215 
            merged_configs["base_url"] = os.environ.get(
                "OPENAI_API_BASE", "https://api.openai.com/v1"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3edb7170167a9fc0 — Environment-variable access.
repo/lightrag/llm/openai.py:1070 
    deployment = os.getenv("AZURE_OPENAI_DEPLOYMENT") or model or os.getenv("LLM_MODEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7c03040fbc91f556 — Environment-variable access.
repo/lightrag/llm/openai.py:1072 
        base_url or os.getenv("AZURE_OPENAI_ENDPOINT") or os.getenv("LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #49b5c63a9a393862 — Environment-variable access.
repo/lightrag/llm/openai.py:1075 
        api_key or os.getenv("AZURE_OPENAI_API_KEY") or os.getenv("LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4bc45c8ae556a757 — Environment-variable access.
repo/lightrag/llm/openai.py:1079 
        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #62b4b81ab423e906 — Environment-variable access.
repo/lightrag/llm/openai.py:1080 
        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d3cd2f1fd90eb891 — Environment-variable access.
repo/lightrag/llm/openai.py:1120 
        os.getenv("LLM_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c6a6e4f0d1473419 — Environment-variable access.
repo/lightrag/llm/openai.py:1189 
        os.getenv("AZURE_EMBEDDING_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #efad17e1f7405f82 — Environment-variable access.
repo/lightrag/llm/openai.py:1191 
        or os.getenv("EMBEDDING_MODEL", "text-embedding-3-small")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c92230ccf041e905 — Environment-variable access.
repo/lightrag/llm/openai.py:1195 
        or os.getenv("AZURE_EMBEDDING_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c291cb8446974c67 — Environment-variable access.
repo/lightrag/llm/openai.py:1196 
        or os.getenv("EMBEDDING_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99721b3d6768ec01 — Environment-variable access.
repo/lightrag/llm/openai.py:1200 
        or os.getenv("AZURE_EMBEDDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab65cd207e956cfb — Environment-variable access.
repo/lightrag/llm/openai.py:1201 
        or os.getenv("EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3d26100e1f54cb94 — Environment-variable access.
repo/lightrag/llm/openai.py:1205 
        or os.getenv("AZURE_EMBEDDING_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23dea54017f224f8 — Environment-variable access.
repo/lightrag/llm/openai.py:1206 
        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b338b802577d8e8a — Environment-variable access.
repo/lightrag/llm/openai.py:1207 
        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a5a314a10b17391d — Environment-variable access.
repo/lightrag/llm/voyageai.py:98 
        api_key = os.environ.get("VOYAGE_API_KEY") or os.environ.get("VOYAGEAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #219846d69dfb1033 — Environment-variable access.
repo/lightrag/multimodal_context.py:697 
    raw = os.getenv("CHUNK_R_SEPARATORS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0445302535180006 — Environment-variable access.
repo/lightrag/multimodal_context.py:762 
        raw = os.getenv(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5e586bbd423c0f76 — Filesystem access.
repo/lightrag/multimodal_context.py:952 
            payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c9f5fec0345820aa — Filesystem access.
repo/lightrag/multimodal_context.py:997 
            sidecar_path.write_text(
                json.dumps(payload, ensure_ascii=False, indent=2),
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #61adab8befa2dbfb — Filesystem access.
repo/lightrag/parser/docx/parse_document.py:113 
        with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2ef933161fd52bc4 — Environment-variable access.
repo/lightrag/parser/docx/utils.py:90 
    return os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c16499456b3c424 — Environment-variable access.
repo/lightrag/parser/docx/utils.py:121 
        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #193a478a2cd5fa77 — Environment-variable access.
repo/lightrag/parser/docx/utils.py:122 
        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa453622bcfe8a3a — Environment-variable access.
repo/lightrag/parser/docx/utils.py:123 
        base_url = os.getenv("GOOGLE_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7efa2d4563cb659f — Environment-variable access.
repo/lightrag/parser/docx/utils.py:143 
        api_key = os.getenv("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5bdb34e32820a4d5 — Environment-variable access.
repo/lightrag/parser/docx/utils.py:164 
        project = os.getenv("GOOGLE_CLOUD_PROJECT", "unknown")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b2496eead2d2c5da — Environment-variable access.
repo/lightrag/parser/docx/utils.py:165 
        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f95bafbfa95c0df8 — Environment-variable access.
repo/lightrag/parser/docx/utils.py:189 
    api_key = os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9eccfe6ea5214229 — Environment-variable access.
repo/lightrag/parser/docx/utils.py:193 
    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #48239a7ed8729d46 — Environment-variable access.
repo/lightrag/parser/docx/utils.py:207 
    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac9e0181e3991909 — Environment-variable access.
repo/lightrag/parser/external/_common.py:70 
    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f82bd57b5dca5fb6 — Environment-variable access.
repo/lightrag/parser/external/_common.py:79 
    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #560cc63198f65343 — Environment-variable access.
repo/lightrag/parser/external/_common.py:93 
    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1ee99f2031a2e78 — Filesystem access.
repo/lightrag/parser/external/_manifest.py:132 
        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53c278f58f4a54fe — Filesystem access.
repo/lightrag/parser/external/_manifest.py:152 
    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f8eb1a09f4e1c10b — Environment-variable access.
repo/lightrag/parser/external/docling/cache.py:84 
    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6475992ed94b3ac5 — Environment-variable access.
repo/lightrag/parser/external/docling/cache.py:138 
        "DOCLING_OCR_ENGINE": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #542ecfb692c83f1b — Environment-variable access.
repo/lightrag/parser/external/docling/cache.py:139 
        "DOCLING_OCR_PRESET": os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #219db965b739dae1 — Environment-variable access.
repo/lightrag/parser/external/docling/cache.py:140 
        "DOCLING_OCR_LANG": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18cdec7942e7d876 — Environment-variable access.
repo/lightrag/parser/external/docling/cache.py:177 
    cur_engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37038d72685ec2a9 — Environment-variable access.
repo/lightrag/parser/external/docling/client.py:98 
        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d63450d6b8c1824f — Environment-variable access.
repo/lightrag/parser/external/docling/client.py:106 
        self.ocr_engine = os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06c947aebebea20d — Environment-variable access.
repo/lightrag/parser/external/docling/client.py:107 
        self.ocr_preset = os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d29e29f5492caf9d — Environment-variable access.
repo/lightrag/parser/external/docling/client.py:108 
        self.ocr_lang_raw = os.getenv("DOCLING_OCR_LANG", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a2edd7b1febbd245 — Environment-variable access.
repo/lightrag/parser/external/docling/ir_builder.py:81 
        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9682f498aa6746a2 — Filesystem access.
repo/lightrag/parser/external/docling/ir_builder.py:109 
            doc = json.loads(main_json.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0084a39e2457958 — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:109 
    mode = _normalize_api_mode(os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ea9243d420b343d2 — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:119 
    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aedddf316bd21e33 — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:128 
    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f1f0ee336efbabf5 — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:144 
            os.getenv("MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #043d4d6ab500868d — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:149 
        return os.getenv("MINERU_LOCAL_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb63a2ecede23a8d — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:220 
            overrides.get("page_range", os.getenv("MINERU_PAGE_RANGES", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #16e3623625f7bfb6 — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:225 
                    "language", os.getenv("MINERU_LANGUAGE", DEFAULT_MINERU_LANGUAGE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2477a2a33919625e — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:234 
                    os.getenv(
                        "MINERU_LOCAL_PARSE_METHOD", DEFAULT_MINERU_LOCAL_PARSE_METHOD
                    ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2926b57a6486d2be — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:252 
                os.getenv("MINERU_MODEL_VERSION", DEFAULT_MINERU_MODEL_VERSION).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa7086c76d0b5c3b — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:263 
                os.getenv("MINERU_LOCAL_BACKEND", DEFAULT_MINERU_LOCAL_BACKEND).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85371e14c0f61f5e — Environment-variable access.
repo/lightrag/parser/external/mineru/cache.py:379 
    cur_engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8490401ef8cabd2e — Environment-variable access.
repo/lightrag/parser/external/mineru/client.py:122 
            os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE).strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fcaef1a1d4d1845d — Environment-variable access.
repo/lightrag/parser/external/mineru/client.py:131 
            os.getenv(
                "MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT
            ).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ee099c45cab84b8 — Environment-variable access.
repo/lightrag/parser/external/mineru/client.py:137 
            os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18dde921faec89eb — Environment-variable access.
repo/lightrag/parser/external/mineru/client.py:139 
        self.api_token = os.getenv("MINERU_API_TOKEN", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32ba4594de4bba58 — Environment-variable access.
repo/lightrag/parser/external/mineru/client.py:162 
        self.poll_interval = float(os.getenv("MINERU_POLL_INTERVAL_SECONDS", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2475a8719a5a8112 — Environment-variable access.
repo/lightrag/parser/external/mineru/client.py:164 
        self.max_polls = int(os.getenv("MINERU_MAX_POLLS", "600"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d53dd80ae2effff7 — Environment-variable access.
repo/lightrag/parser/external/mineru/client.py:165 
        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #29f8902f6ee47aa2 — Filesystem access.
repo/lightrag/parser/external/mineru/client.py:679 
            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e972cd43a5f75c0 — Environment-variable access.
repo/lightrag/parser/external/mineru/ir_builder.py:86 
        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #30948872095c0b89 — Environment-variable access.
repo/lightrag/parser/external/mineru/ir_builder.py:90 
        self.image_url_template = os.getenv("MINERU_IMAGE_URL_TEMPLATE", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3f2df41eca26e201 — Environment-variable access.
repo/lightrag/parser/external/mineru/ir_builder.py:95 
        raw = os.getenv("MINERU_BBOX_ATTRIBUTES", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb9dbf83a389a800 — Filesystem access.
repo/lightrag/parser/external/mineru/ir_builder.py:139 
        content_list = json.loads(content_list_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #44872a0f75ad9303 — Filesystem access.
repo/lightrag/parser/external/mineru/manifest.py:126 
        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a065886f1c385eee — Filesystem access.
repo/lightrag/parser/external/mineru/manifest.py:147 
    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9101cc76a374227b — Environment-variable access.
repo/lightrag/parser/legacy/parser.py:47 
        pdf_password = os.getenv("PDF_DECRYPT_PASSWORD") or None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1155da7f8b1df30a — Environment-variable access.
repo/lightrag/parser/markdown/parser.py:209 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f7699077a6fa2ef — Environment-variable access.
repo/lightrag/parser/markdown/parser.py:216 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c0c1dd49d10332f5 — Environment-variable access.
repo/lightrag/parser/markdown/parser.py:228 
    raw = os.getenv("NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8eb9d08bbf95ef72 — Filesystem access.
repo/lightrag/parser/markdown/parser.py:456 
        data = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9cec7a9dfe1dd5b — Filesystem access.
repo/lightrag/parser/markdown/parser.py:572 
            md_text = source.read_bytes().decode("utf-8-sig")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ee8a2d4cf1728404 — Filesystem access.
repo/lightrag/parser/markdown/parser.py:583 
            source.read_bytes(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c791745f4090ad3a — Filesystem access.
repo/lightrag/parser/markdown/parser.py:589 
        return text_file.read_bytes().decode("utf-8-sig"), text_file.parent

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #98439e670a3e446f — Environment-variable access.
repo/lightrag/parser/markdown/raw_cache.py:49 
        "max_bytes": os.getenv("NATIVE_MD_IMAGE_MAX_BYTES", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b3c3d11bd19feab — Environment-variable access.
repo/lightrag/parser/markdown/raw_cache.py:50 
        "max_svg_pixels": os.getenv("NATIVE_MD_IMAGE_MAX_SVG_PIXELS", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1d8e3652199de66b — Environment-variable access.
repo/lightrag/parser/markdown/raw_cache.py:51 
        "allowed_non_public_cidrs": os.getenv(
            "NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", ""
        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd734fa0bc0248fa — Filesystem access.
repo/lightrag/parser/markdown/raw_cache.py:136 
            data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5dd029f5c34e3bb4 — Filesystem access.
repo/lightrag/parser/markdown/raw_cache.py:194 
            tmp.write_text(
                json.dumps(manifest, ensure_ascii=False, indent=2), encoding="utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4dd5b228e01a0882 — Filesystem access.
repo/lightrag/parser/markdown/raw_cache.py:214 
            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d3912d1dabc27560 — Environment-variable access.
repo/lightrag/parser/param_schema.py:410 
    return (os.getenv("MINERU_API_MODE", "") or "").strip().lower() != "official"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #47ef8b7f1e79df65 — Environment-variable access.
repo/lightrag/parser/registry.py:45 
    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ca935804c781d8f6 — Environment-variable access.
repo/lightrag/parser/registry.py:47 
        return bool(os.getenv("MINERU_API_TOKEN", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e9256d3e31e5f86 — Environment-variable access.
repo/lightrag/parser/registry.py:49 
        return bool(os.getenv("MINERU_LOCAL_ENDPOINT", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b644ca89f0169ff3 — Environment-variable access.
repo/lightrag/parser/registry.py:54 
    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7c10c251b70bff35 — Environment-variable access.
repo/lightrag/parser/registry.py:64 
    return lambda: bool(os.getenv(env_name, "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c98ca1c46f39ff24 — Environment-variable access.
repo/lightrag/parser/routing.py:317 
            p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4340609f8dabf29 — Environment-variable access.
repo/lightrag/parser/routing.py:328 
        if os.getenv("CHUNK_P_DROP_REFERENCES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc0ec14b2209eae9 — Environment-variable access.
repo/lightrag/parser/routing.py:337 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #15404f1b2174dd9a — Environment-variable access.
repo/lightrag/parser/routing.py:347 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c425b9c916e2b688 — Environment-variable access.
repo/lightrag/parser/routing.py:398 
                os.getenv("CHUNK_R_SEPARATORS", json.dumps(list(DEFAULT_R_SEPARATORS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e86b32648b8c77b3 — Environment-variable access.
repo/lightrag/parser/routing.py:402 
            "breakpoint_threshold_type": os.getenv(
                "CHUNK_V_BREAKPOINT_THRESHOLD_TYPE", "percentile"
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64e636b19dec8cd4 — Environment-variable access.
repo/lightrag/parser/routing.py:406 
                os.getenv("CHUNK_V_BREAKPOINT_THRESHOLD_AMOUNT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83571e94b60822bf — Environment-variable access.
repo/lightrag/parser/routing.py:408 
            "buffer_size": int(os.getenv("CHUNK_V_BUFFER_SIZE", "1")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f481463794663e01 — Environment-variable access.
repo/lightrag/parser/routing.py:413 
            "sentence_split_regex": os.getenv(
                "CHUNK_V_SENTENCE_SPLIT_REGEX", DEFAULT_SENTENCE_SPLIT_REGEX
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0f778a0a953bfc7 — Environment-variable access.
repo/lightrag/parser/routing.py:423 
    f_overlap_raw = os.getenv("CHUNK_F_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #11af143dfd2ce399 — Environment-variable access.
repo/lightrag/parser/routing.py:426 
    r_overlap_raw = os.getenv("CHUNK_R_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e863385e93ce5f76 — Environment-variable access.
repo/lightrag/parser/routing.py:429 
    p_overlap_raw = os.getenv("CHUNK_P_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ba192c2047061d60 — Environment-variable access.
repo/lightrag/parser/routing.py:443 
    p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #125d718d69f0142e — Environment-variable access.
repo/lightrag/parser/routing.py:454 
    f_size_raw = os.getenv("CHUNK_F_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07bee1ac8d3d90b8 — Environment-variable access.
repo/lightrag/parser/routing.py:457 
    r_size_raw = os.getenv("CHUNK_R_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a76dc04623908696 — Environment-variable access.
repo/lightrag/parser/routing.py:460 
    v_size_raw = os.getenv("CHUNK_V_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39e0fe574d0bfb43 — Environment-variable access.
repo/lightrag/parser/routing.py:918 
    return os.getenv("LIGHTRAG_PARSER", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07fb0b6d1bf28ef7 — Filesystem access.
repo/lightrag/pipeline.py:3375 
            lines = block_file.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5d37143579051b95 — Environment-variable access.
repo/lightrag/pipeline.py:3410 
                int(os.getenv("VLM_MAX_IMAGE_BYTES", str(5 * 1024 * 1024))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06a95fdd707f1656 — Environment-variable access.
repo/lightrag/pipeline.py:3414 
                int(os.getenv("VLM_MIN_IMAGE_PIXEL", str(DEFAULT_MM_IMAGE_MIN_PIXEL))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72b3bfa505c7f589 — Filesystem access.
repo/lightrag/pipeline.py:3654 
                    raw = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2eed13032bec8d8d — Filesystem access.
repo/lightrag/pipeline.py:4040 
                    payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1e53a2ad261d49f — Filesystem access.
repo/lightrag/pipeline.py:4168 
                    sidecar_path.write_text(
                        json.dumps(payload, ensure_ascii=False, indent=2),
                        encoding="utf-8",
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #343319cb67b95397 — Filesystem access.
repo/lightrag/pipeline.py:4358 
                payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8edc80fabf5a36e9 — Environment-variable access.
repo/lightrag/prompt.py:562 
    configured = os.getenv("PROMPT_DIR", "").strip() or _DEFAULT_PROMPT_DIR

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #497db9811cce1a7e — Filesystem access.
repo/lightrag/prompt.py:635 
        content = profile_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #827f002834d17a3c — Environment-variable access.
repo/lightrag/rerank.py:418 
        api_key = os.getenv("COHERE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d38fcd6562e5ed7b — Environment-variable access.
repo/lightrag/rerank.py:460 
        api_key = os.getenv("JINA_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6400cd0accc00e84 — Environment-variable access.
repo/lightrag/rerank.py:500 
        api_key = os.getenv("DASHSCOPE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71cc4ccaaf9dc17e — Filesystem access.
repo/lightrag/sidecar/writer.py:330 
    blocks_path.write_text(
        "\n".join([json.dumps(meta, ensure_ascii=False)] + blocks_lines) + "\n",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d972b73fc78a1eca — Filesystem access.
repo/lightrag/sidecar/writer.py:339 
        tables_path.write_text(
            json.dumps(
                {"version": "1.0", "tables": tables},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4540d1309e071672 — Filesystem access.
repo/lightrag/sidecar/writer.py:349 
        drawings_path.write_text(
            json.dumps(
                {"version": "1.0", "drawings": drawings},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bccf718b5264c634 — Filesystem access.
repo/lightrag/sidecar/writer.py:359 
        equations_path.write_text(
            json.dumps(
                {"version": "1.0", "equations": equations},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ad7fcb749d8ebc5 — Environment-variable access.
repo/lightrag/tools/clean_llm_query_cache.py:141 
            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d688f6df64ee0602 — Environment-variable access.
repo/lightrag/tools/clean_llm_query_cache.py:146 
        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0691b27dbe85340 — Environment-variable access.
repo/lightrag/tools/clean_llm_query_cache.py:198 
        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #033ed75a31e545cc — Environment-variable access.
repo/lightrag/tools/clean_llm_query_cache.py:266 
            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #493f46ce503924de — Environment-variable access.
repo/lightrag/tools/download_cache.py:34 
        os.environ["TIKTOKEN_CACHE_DIR"] = cache_dir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f76f942b099c92f9 — Environment-variable access.
repo/lightrag/tools/download_cache.py:40 
        env_cache_dir = os.environ.get("TIKTOKEN_CACHE_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f9bf99365f9e1592 — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:126 
            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #855fcb229d9817bf — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:131 
        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f6e966bb06d2f871 — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:183 
        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #44b897cc514185be — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:219 
                has_env = all(var in os.environ for var in required_vars)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #596177663c449a80 — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:279 
            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f46a67fea7bc2be1 — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:1090 
                    if "REDIS_URI" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8b03b9b588d455b7 — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:1098 
                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aa24d5f1dcb864b8 — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:1108 
                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #836f53e2ea19c78f — Environment-variable access.
repo/lightrag/tools/migrate_llm_cache.py:1118 
                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65de881306ee9f81 — Environment-variable access.
repo/lightrag/tools/prepare_qdrant_legacy_data.py:154 
                url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7acce565aa5802d2 — Environment-variable access.
repo/lightrag/tools/prepare_qdrant_legacy_data.py:154 
                url=os.environ.get(
                    "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #692445d58cfb6464 — Environment-variable access.
repo/lightrag/tools/prepare_qdrant_legacy_data.py:157 
                api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9816b470eafa397f — Environment-variable access.
repo/lightrag/tools/prepare_qdrant_legacy_data.py:157 
                api_key=os.environ.get(
                    "QDRANT_API_KEY",
                    config.get("qdrant", "apikey", fallback=None),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e8d38e3eb7b7b18 — Environment-variable access.
repo/lightrag/tools/rebuild_vdb.py:584 
            "graph": os.getenv("LIGHTRAG_GRAPH_STORAGE", "NetworkXStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #57ad0c9f0fed97f0 — Environment-variable access.
repo/lightrag/tools/rebuild_vdb.py:585 
            "vector": os.getenv("LIGHTRAG_VECTOR_STORAGE", "NanoVectorDBStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1589084e67ce6b6b — Environment-variable access.
repo/lightrag/tools/rebuild_vdb.py:586 
            "kv": os.getenv("LIGHTRAG_KV_STORAGE", "JsonKVStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b162cc671dcf721 — Environment-variable access.
repo/lightrag/tools/rebuild_vdb.py:592 
        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a92e5612ee8a0b6 — Environment-variable access.
repo/lightrag/tools/rebuild_vdb.py:625 
            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45a204852515c8ea — Environment-variable access.
repo/lightrag/tools/rebuild_vdb.py:654 
                    os.getenv("TIKTOKEN_MODEL_NAME", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e5416861c95a50bd — Environment-variable access.
repo/lightrag/tools/rebuild_vdb.py:666 
        self.workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef04dbdea775c727 — Environment-variable access.
repo/lightrag/utils.py:269 
    value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0aa442e728f06c1 — Environment-variable access.
repo/lightrag/utils.py:315 
VERBOSE_DEBUG = os.getenv("VERBOSE", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8d8d8623d4b58514 — Environment-variable access.
repo/lightrag/utils.py:317 
    os.getenv("LIGHTRAG_PERFORMANCE_TIMING_LOGS", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e399c1b486c3de30 — Environment-variable access.
repo/lightrag/utils.py:442 
            log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2a85c44c3cc2e93f — Filesystem access.
repo/lightrag/utils.py:2332 
    with open(file_name, encoding="utf-8-sig") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #355477e353f2ae3e — Filesystem access.
repo/lightrag/utils.py:2450 
            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2b55122e4b4831be — Filesystem access.
repo/lightrag/utils.py:2457 
            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7430827dc696eb5b — Filesystem access.
repo/lightrag/utils.py:3158 
        with open(output_path, "w", newline="", encoding="utf-8") as csvfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a8e7d44040ec994e — Filesystem access.
repo/lightrag/utils.py:3208 
        with open(output_path, "w", encoding="utf-8") as mdfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #26d5cde0d02f0887 — Filesystem access.
repo/lightrag/utils.py:3270 
        with open(output_path, "w", encoding="utf-8") as txtfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e019a5685a9ab060 — Environment-variable access.
repo/lightrag/utils.py:3982 
    missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #11757f5e9ed75be0 — Environment-variable access.
repo/lightrag/utils_pipeline.py:541 
    input_dir = os.getenv("INPUT_DIR", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe953227cff998f0 — Filesystem access.
repo/reproduce/Step_0.py:24 
            with open(file_path, "r", encoding="utf-8") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72a6315bb5e0a5f0 — Filesystem access.
repo/reproduce/Step_0.py:51 
            with open(output_path, "w", encoding="utf-8") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #021711c4d14d73df — Filesystem access.
repo/reproduce/Step_1.py:10 
    with open(file_path, mode="r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #50d108cd3dbc1dca — Environment-variable access.
repo/reproduce/Step_1_openai_compatible.py:22 
        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e267ede19406b280 — Environment-variable access.
repo/reproduce/Step_1_openai_compatible.py:32 
        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23117dbe8daaba22 — Filesystem access.
repo/reproduce/Step_1_openai_compatible.py:41 
    with open(file_path, mode="r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7123a980d20adf90 — Filesystem access.
repo/reproduce/Step_2.py:41 
    with open(f"../datasets/unique_contexts/{cls}_unique_contexts.json", mode="r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #833f98b941d37f44 — Filesystem access.
repo/reproduce/Step_2.py:75 
    with open(file_path, "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #58a6a761007fe4c2 — Filesystem access.
repo/reproduce/Step_3.py:8 
    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3f691fdc6e0f046e — Filesystem access.
repo/reproduce/Step_3.py:32 
        open(output_file, "a", encoding="utf-8") as result_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb400aa3b65546b7 — Filesystem access.
repo/reproduce/Step_3.py:33 
        open(error_file, "a", encoding="utf-8") as err_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e5ca4db1453db40c — Environment-variable access.
repo/reproduce/Step_3_openai_compatible.py:20 
        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3a420f39b58a54db — Environment-variable access.
repo/reproduce/Step_3_openai_compatible.py:30 
        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6aad952af801490b — Filesystem access.
repo/reproduce/Step_3_openai_compatible.py:39 
    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f358bc19be61443d — Filesystem access.
repo/reproduce/Step_3_openai_compatible.py:63 
        open(output_file, "a", encoding="utf-8") as result_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #753ccda049fe5c6a — Filesystem access.
repo/reproduce/Step_3_openai_compatible.py:64 
        open(error_file, "a", encoding="utf-8") as err_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b0c119af1b4b4e78 — Filesystem access.
repo/reproduce/batch_eval.py:11 
    with open(query_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bdb0ba953b417ed7 — Filesystem access.
repo/reproduce/batch_eval.py:16 
    with open(result1_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b0b655eac7670bc — Filesystem access.
repo/reproduce/batch_eval.py:20 
    with open(result2_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #810ea85885d51da8 — Filesystem access.
repo/reproduce/batch_eval.py:97 
        file=open(output_file_path, "rb"), purpose="batch"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6d0423229f42fabf — Filesystem access.
repo/scripts/release/set_version.py:46 
    content = VERSION_FILE.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a0a14a99ef28671e — Filesystem access.
repo/scripts/release/set_version.py:51 
    VERSION_FILE.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

anthropic

python dependency
high pii_flow dependency Excluded from app score #ab0f00b8424c43a0 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:384 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:384 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:384 
            self._owned_http_client = httpx.Client(timeout=TOKEN_EXCHANGE_TIMEOUT)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow dependency Excluded from app score #c06adfd564100cb3 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_workload.py:179 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/anthropic/lib/credentials/_workload.py:179 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/anthropic/lib/credentials/_workload.py:179 
            self._http_client = httpx.Client(timeout=TOKEN_EXCHANGE_TIMEOUT)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 90 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #1f241f0ed63e832e — Environment-variable access.
pkgs/python/[email protected]/examples/agents.py:9 
    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9b8780e52f998c3d — Environment-variable access.
pkgs/python/[email protected]/examples/agents_comprehensive.py:18 
    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #198b076f08293afb — Environment-variable access.
pkgs/python/[email protected]/examples/agents_comprehensive.py:20 
    github_token = os.environ.get("GITHUB_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5d52ae0aa1aacf93 — Filesystem access.
pkgs/python/[email protected]/examples/agents_comprehensive.py:47 
    with open(skill_md_path, "rb") as skill_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ec989232b74a302c — Environment-variable access.
pkgs/python/[email protected]/examples/agents_with_files.py:10 
    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #920ebe13080f9051 — Environment-variable access.
pkgs/python/[email protected]/examples/managed-agents-observe-tool-calls.py:46 
    val = os.environ.get(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #91f70e2073de5144 — Environment-variable access.
pkgs/python/[email protected]/examples/managed-agents-observe-tool-calls.py:64 
    workdir = os.environ.get("ANTHROPIC_WORKDIR", ".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #abcaace0dfed7e81 — Environment-variable access.
pkgs/python/[email protected]/examples/managed-agents-self-hosted-sandbox-worker.py:48 
    val = os.environ.get(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d5a972e5ab119755 — Environment-variable access.
pkgs/python/[email protected]/examples/managed-agents-self-hosted-sandbox-worker.py:60 
    workdir = os.environ.get("ANTHROPIC_WORKDIR", ".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #de012e59feb811d4 — Environment-variable access.
pkgs/python/[email protected]/examples/workload_identity.py:70 
        identity_token_provider=lambda: os.environ["ANTHROPIC_IDENTITY_TOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69fc906e8dbcb782 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:107 
    if api_key is not None and os.environ.get("ANTHROPIC_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7e066c272c2491f — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:109 
    if auth_token is not None and os.environ.get("ANTHROPIC_AUTH_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a88bce72b70f061b — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:214 
            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12b6f8a7e43e3054 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:215 
            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e88a8ceefb32128 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:221 
            webhook_key = os.environ.get("ANTHROPIC_WEBHOOK_SIGNING_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2687127845702aa — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:225 
            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b683927b56e85a36 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:234 
        custom_headers_env = os.environ.get("ANTHROPIC_CUSTOM_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ae5c156f659da92 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:631 
            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45db725214fdebb3 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:632 
            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8511f91772b5a820 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:638 
            webhook_key = os.environ.get("ANTHROPIC_WEBHOOK_SIGNING_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2421b888d09a8be — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:642 
            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b684c52d1cfc0a3 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_client.py:651 
        custom_headers_env = os.environ.get("ANTHROPIC_CUSTOM_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47ec7bdff2a160ae — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:69 
            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61b47a04b78cbd1f — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:81 
        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2eccfce593b868a2 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:111 
            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97f889b2665ce8cc — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_files.py:123 
        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d3933e9957128ac — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_legacy_response.py:464 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0466f6442e5a8add — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_legacy_response.py:477 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad2bcf4bc7ae1840 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_models.py:120 
            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77e4a59b42e426de — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_response.py:537 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8edc6c54ae127b44 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_response.py:579 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6238f3f037bbe4fb — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/_utils/_logs.py:17 
    env = os.environ.get("ANTHROPIC_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f254e7a1f89346dd — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:250 
            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2661a0244576b64e — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:418 
            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #841e567063ee240a — Filesystem access.
pkgs/python/[email protected]/src/anthropic/_utils/_utils.py:379 
    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68919a0d84a847f9 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/_files.py:25 
        files.append((path.relative_to(relative_to).as_posix(), path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb8db6f49b4e7604 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/_files.py:42 
        files.append((path.relative_to(relative_to).as_posix(), await path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03bd45086971f473 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/aws/_credentials.py:25 
        value = os.environ.get(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f20b8842cfbd756 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/aws/_credentials.py:90 
    return os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #043168715cb1f4c3 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:77 
    aws_region = os.environ.get("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca5ce10d5e68132b — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:165 
            api_key = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02e75e68bc19b4b8 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:190 
            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9a0351e036dc41d — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:345 
            api_key = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f29cff3dfcb68610 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:370 
            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88dd94e14822700e — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/bedrock/_mantle.py:144 
        base_url = os.environ.get("ANTHROPIC_BEDROCK_MANTLE_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a862cc1d63303766 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:33 
    federation_rule_id = os.environ.get(ENV_FEDERATION_RULE_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bee912de1b46f65 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:34 
    organization_id = os.environ.get(ENV_ORGANIZATION_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc00d22618def2a5 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:35 
    has_literal_token = ENV_IDENTITY_TOKEN in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7da555c14290f4f6 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:50 
            value = os.environ.get(ENV_IDENTITY_TOKEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5453af2990c23977 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:65 
        service_account_id=os.environ.get(ENV_SERVICE_ACCOUNT_ID),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2594448368d70dce — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:69 
        workspace_id=os.environ.get(ENV_WORKSPACE_ID) or None,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb77a42a4eff8b7f — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:70 
        scope=os.environ.get(ENV_SCOPE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dbc39b10b5c95948 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:108 
    if os.environ.get(ENV_API_KEY):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17838ede6159b145 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:112 
    auth_token = os.environ.get(ENV_AUTH_TOKEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5186c0be7de6caad — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:119 
    env_explicit = bool(os.environ.get(ENV_PROFILE) or os.environ.get(ENV_CONFIG_DIR))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cba7046e73b36ee9 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:78 
    env = os.environ.get(ENV_CONFIG_DIR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0ad9bb5441ef490 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:82 
        appdata = os.environ.get("APPDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a1ebdf76649a0aa — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:92 
        name = (_config_dir() / "active_config").read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62d57ab002799e90 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:105 
    env = os.environ.get(ENV_PROFILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fafc8be2eaba00f — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:224 
    env = os.environ.get(ENV_IDENTITY_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7fb94b7c9c607ef — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:240 
    if os.environ.get(ENV_PROFILE) or os.environ.get(ENV_CONFIG_DIR):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31fc97d6894d9c60 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:244 
    if os.environ.get(ENV_FEDERATION_RULE_ID) and os.environ.get(ENV_ORGANIZATION_ID):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81ad4eb201ba13cc — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:245 
        if os.environ.get(ENV_IDENTITY_TOKEN_FILE) or os.environ.get(ENV_IDENTITY_TOKEN):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3b9e1db567eff37 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:88 
            v = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b09387a41ac1567 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:102 
            v = os.environ.get(ENV_IDENTITY_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb6bbf377a547e9c — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:128 
        value = os.environ.get(self._env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #442acfae04ced97f — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:276 
            raw = self._config_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7f17ec39540081b — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:357 
            raw = path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5adb95633e25758a — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:692 
            content = self._path.read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1d8729a74fdb6c2 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/environments/_worker.py:160 
    resolved = value or os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e67c7cd701411100 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:157 
        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ff508b393d01737 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:158 
        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ae5b99ea619e01f — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:159 
        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e3efc314c820789 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:382 
        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c662ab1277767c02 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:383 
        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b68f75811cf24218 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/foundry.py:384 
        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #4436b3e30d726a47 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:356 
        return full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #e9e60e0383c4849a — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:653 
        return await full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #01baabedc2b40d93 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/_skills.py:138 
                with zf.open(info) as src, open(target, "wb") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #ce73bb5d625a1144 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/_skills.py:164 
            with extracted as src, open(target, "wb") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #ac73deea0a9fbb78 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:123 
    return {k: v for k, v in os.environ.items() if not k.startswith("ANTHROPIC_")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #14f8dc4931122720 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:512 
            text = target.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #29542a66c08b11d5 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:540 
            target.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #7fa5e50d1844c391 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:570 
            text = target.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #2b414170b14c9728 — Filesystem access.
pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:582 
            target.write_text(updated)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afc615a86749f3da — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:46 
        project_id = os.environ.get("ANTHROPIC_VERTEX_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42cbe13e6485ee64 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:114 
            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2502a14653041161 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:121 
            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9994152d77fd0e7 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:278 
            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c731055a719aa32 — Environment-variable access.
pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:285 
            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

lightrag-hku

python dependency
high pii_flow dependency Excluded from app score #b46add44522824d1 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:597 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:564 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:597 
        limits = httpx.Limits(
            max_connections=(max_async + 1) * 2,  # Allow buffer for RAG stage
            max_keepalive_connections=max_async + 1,
        )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow dependency Excluded from app score #e74800a229611329 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:602 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:564 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:602 
        async with httpx.AsyncClient(timeout=timeout, limits=limits) as client:

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 442 low-confidence finding(s)
low env_fs dependency Excluded from app score #6d462199b8714b44 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:73 
        "ollama": os.getenv("LLM_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e06de51a7877b135 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:74 
        "lollms": os.getenv("LLM_BINDING_HOST", "http://localhost:9600"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #683b69db07e5fb50 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:75 
        "azure_openai": os.getenv("AZURE_OPENAI_ENDPOINT", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f1563816d101e20 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:76 
        "openai": os.getenv("LLM_BINDING_HOST", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8114733deb3002bd — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:79 
        "bedrock": os.getenv("LLM_BINDING_HOST", "DEFAULT_BEDROCK_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98ad0dac44c41fa7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:82 
        "gemini": os.getenv("LLM_BINDING_HOST", "DEFAULT_GEMINI_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #492ce424be31a7bd — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:85 
        binding_type, os.getenv("LLM_BINDING_HOST", "http://localhost:11434")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3053ce0f6f15b90a — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:143 
    if env_key not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfcdb50c84c11510 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:146 
    value = os.environ[env_key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bd9ffa05776b790 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:176 
    bearer_token = os.getenv("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86990979c1319453 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/config.py:733 
    args.embedding_asymmetric_configured = "EMBEDDING_ASYMMETRIC" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e9386fe74b54af2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/gunicorn_config.py:14 
log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #834a499876bda8d2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/gunicorn_config.py:40 
errorlog = os.getenv("ERROR_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #961b152b848fe10a — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/gunicorn_config.py:41 
accesslog = os.getenv("ACCESS_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a87e7c51d4399604 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:81 
webui_title = os.getenv("WEBUI_TITLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eeb72ab472bfce91 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:82 
webui_description = os.getenv("WEBUI_DESCRIPTION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7a6c3ce4bd909ee — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:490 
    api_mode_raw = os.getenv("MINERU_API_MODE", "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a436881d8b516fd5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:494 
        endpoint = os.getenv("MINERU_OFFICIAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fd60fc81e9661f4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:496 
        endpoint = os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc802a53a3a7f608 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:523 
    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6eb85a60fc975149 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:531 
            "ocr_engine": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #581b8060718fc0c7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:532 
            "ocr_lang": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60edeb88600c603f — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1262 
    api_key = os.getenv("LIGHTRAG_API_KEY") or args.key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e40aeb45210980c6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1289 
            if "LIGHTRAG_GUNICORN_MODE" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #150fd525933a9c1b — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1513 
                api_key=os.getenv("AZURE_OPENAI_API_KEY", args.llm_binding_api_key),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0594c7bad02f5917 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1514 
                api_version=os.getenv("AZURE_OPENAI_API_VERSION", "2024-08-01-preview"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de352c7b71eada32 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1828 
                        api_key=role_apikey or os.getenv("AZURE_OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60bcd3e6737af235 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1829 
                        api_version=os.getenv(
                            "AZURE_OPENAI_API_VERSION", "2024-08-01-preview"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6d44aefc58dc0df — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1993 
                    os.getenv("RERANK_ENABLE_CHUNKING", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dbb4fcfc3d47649b — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1996 
                    os.getenv("RERANK_MAX_TOKENS_PER_DOC", "4096")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6d39873dc4f2995 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2364 
                if os.environ.get("LIGHTRAG_GUNICORN_MODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04d6b0d13180cdec — Filesystem access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2459 
                content = Path(response.path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c3efd534197d597 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2529 
    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca23696d16b2e98b — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2634 
    if "GUNICORN_CMD_ARGS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b03232441e6b2b84 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:13 
_PROCESS_START_OBJC_FORK_SAFETY = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1717c7ef3e4c327 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:76 
    os.environ["LIGHTRAG_GUNICORN_MODE"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6a52652a3a5e6e2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:88 
        current_objc_fork_safety = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f59afb29236adac — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:206 
                else os.getenv("HOST", "0.0.0.0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #440b79431a54ecd0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:219 
                else os.getenv("LOG_LEVEL", "info")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdf17ad41db826bc — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:235 
            if global_args.ssl or os.getenv("SSL", "").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23efbc26d1e056a1 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:245 
                    else os.getenv("SSL_CERTFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a02b6319046d8bb2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:250 
                    else os.getenv("SSL_KEYFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64485197fc25db46 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:284 
        os.environ["LIGHTRAG_MAIN_PROCESS"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1f836c9158d1016 — Filesystem access.
pkgs/python/[email protected]/lightrag/api/runtime_validation.py:36 
            return Path(candidate).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14785d70cd8bab37 — Environment-variable access.
pkgs/python/[email protected]/lightrag/api/runtime_validation.py:47 
    environ = environ or os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5b7fdfdfe695592 — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:41 
        self._lightrag_name = name or os.getenv(
            "OLLAMA_EMULATING_MODEL_NAME", DEFAULT_OLLAMA_MODEL_NAME
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdb4d3f6234716d3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:44 
        self._lightrag_tag = tag or os.getenv(
            "OLLAMA_EMULATING_MODEL_TAG", DEFAULT_OLLAMA_MODEL_TAG
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7712d42e14f3932 — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:107 
    top_k: int = int(os.getenv("TOP_K", str(DEFAULT_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a9ad51630b0dd1f — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:110 
    chunk_top_k: int = int(os.getenv("CHUNK_TOP_K", str(DEFAULT_CHUNK_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc1f084d12363cd9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:116 
        os.getenv("MAX_ENTITY_TOKENS", str(DEFAULT_MAX_ENTITY_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bf2a81d6ba580ac — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:121 
        os.getenv("MAX_RELATION_TOKENS", str(DEFAULT_MAX_RELATION_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3ef70cad0a0096e — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:126 
        os.getenv("MAX_TOTAL_TOKENS", str(DEFAULT_MAX_TOTAL_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d1b7c3843412d18 — Environment-variable access.
pkgs/python/[email protected]/lightrag/base.py:148 
    enable_rerank: bool = os.getenv("RERANK_BY_DEFAULT", "true").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd3f93c5d59385e2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/chunker/paragraph_semantic.py:217 
    raw = os.getenv("CHUNK_P_REFERENCES_TAIL_N")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60634dd5730bd5e7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/chunker/paragraph_semantic.py:238 
    raw = os.getenv("CHUNK_P_REFERENCES_HEADINGS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3195727a0747e052 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:147 
        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9775b317a80a40a — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:147 
        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(
            "OPENAI_API_KEY"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab937bd0f6dd783a — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:157 
        eval_model = os.getenv("EVAL_LLM_MODEL", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0779c5931c964c27 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:158 
        eval_llm_base_url = os.getenv("EVAL_LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d79a26050f4f035a — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:163 
            os.getenv("EVAL_EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bff774c875a1706 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:164 
            or os.getenv("EVAL_LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edc33c4ea89d7fb9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:165 
            or os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa2139a12353cce3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:167 
        eval_embedding_model = os.getenv(
            "EVAL_EMBEDDING_MODEL", "text-embedding-3-large"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58bc6829a992adfe — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:171 
        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6d9c3dd072de4bb — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:171 
        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(
            "EVAL_LLM_BINDING_HOST"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3463730647e08b3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:179 
            "max_retries": int(os.getenv("EVAL_LLM_MAX_RETRIES", "5")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfcda6d65e929eee — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:180 
            "request_timeout": int(os.getenv("EVAL_LLM_TIMEOUT", "180")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a37e4735b2c411d — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:218 
            rag_api_url = os.getenv("LIGHTRAG_API_URL", "http://localhost:9621")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a00552d513cec14 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:269 
        query_top_k = int(os.getenv("EVAL_QUERY_TOP_K", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1ea4bba531c75e4 — Filesystem access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:285 
        with open(self.test_dataset_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #831c90078faa9a90 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:316 
                "top_k": int(os.getenv("EVAL_QUERY_TOP_K", "10")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c18b824f5ec4000 — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:320 
            api_key = os.getenv("LIGHTRAG_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a92d92d3f2c85c7e — Environment-variable access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:564 
        max_async = int(os.getenv("EVAL_MAX_CONCURRENT", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d70254370453149c — Filesystem access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:647 
        with open(csv_path, "w", newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #261c5c37779fe2da — Filesystem access.
pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:899 
        with open(json_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be1d213a032d0c65 — Filesystem access.
pkgs/python/[email protected]/lightrag/evaluation/offline_retrieval_check.py:84 
    payload = json.loads(dataset_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18993e90b63ba947 — Filesystem access.
pkgs/python/[email protected]/lightrag/evaluation/offline_retrieval_check.py:92 
    payload = json.loads(oracle_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cf08d429ef420dd — Filesystem access.
pkgs/python/[email protected]/lightrag/evaluation/offline_retrieval_check.py:115 
                tokens=Counter(tokenize(path.read_text(encoding="utf-8"))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03df1b8164900f8a — Filesystem access.
pkgs/python/[email protected]/lightrag/kg/faiss_impl.py:820 
            with open(tmp, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8084480d676a71a6 — Filesystem access.
pkgs/python/[email protected]/lightrag/kg/faiss_impl.py:853 
            with open(self._meta_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #035b405c1427ac04 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:27 
MAX_GRAPH_NODES = int(os.getenv("MAX_GRAPH_NODES", 1000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06070b71747d22e1 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:38 
        memgraph_workspace = os.environ.get("MEMGRAPH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21fc1e3cf2177c69 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:78 
            URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c219e8dcc634bd3e — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:78 
            URI = os.environ.get(
                "MEMGRAPH_URI",
                config.get("memgraph", "uri", fallback="bolt://localhost:7687"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #502d3937229c0af5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:82 
            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d1def87d999e17b — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:82 
            USERNAME = os.environ.get(
                "MEMGRAPH_USERNAME", config.get("memgraph", "username", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #725c4a75d0f52f45 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:85 
            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #833f7557b7b5bfd0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:85 
            PASSWORD = os.environ.get(
                "MEMGRAPH_PASSWORD", config.get("memgraph", "password", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef51408f557b353a — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:88 
            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7e6e44f7d9c115b — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:88 
            DATABASE = os.environ.get(
                "MEMGRAPH_DATABASE",
                config.get("memgraph", "database", fallback="memgraph"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9de33f5675903878 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:159 
    val = os.environ.get(key, "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae12c20874931f4c — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:169 
    val = os.environ.get(key, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93eea62382f43ba9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:212 
            self.index_type or os.environ.get("MILVUS_INDEX_TYPE", "AUTOINDEX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb788a606494b8b9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:217 
            self.metric_type or os.environ.get("MILVUS_METRIC_TYPE", "COSINE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13fda6b9e4ee1286 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:231 
            self.sq_type = os.environ.get("MILVUS_HNSW_SQ_TYPE", "SQ8").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5f08504637681ff — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:235 
            self.sq_refine_type = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da2329db6c121ead — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:235 
            self.sq_refine_type = os.environ.get(
                "MILVUS_HNSW_SQ_REFINE_TYPE", "FP32"
            ).upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #229e85b9908d20a9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:442 
            "uri": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fceae091aa001b41 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:442 
            "uri": os.environ.get(
                "MILVUS_URI",
                config.get(
                    "milvus",
                    "uri",
                    fallback=os.path.join(
                        self.global_config["working_dir"], "milvus_lite.db"
                    ),
                ),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c8b878402cab47b — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:452 
            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cfbd3d15de82269 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:452 
            "user": os.environ.get(
                "MILVUS_USER", config.get("milvus", "user", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #268bbf74d5c918a6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:455 
            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e30d8e93e698185f — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:455 
            "password": os.environ.get(
                "MILVUS_PASSWORD",
                config.get("milvus", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18a3ae121a81b6e7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:459 
            "token": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb728b85b17dbedb — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:459 
            "token": os.environ.get(
                "MILVUS_TOKEN", config.get("milvus", "token", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a55e845428cacbc6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:464 
        db_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a94984dff0e8b29d — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:464 
        db_name = os.environ.get(
            "MILVUS_DB_NAME",
            config.get("milvus", "db_name", fallback=None),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c8733a8b3197c90 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2092 
        milvus_workspace = os.environ.get("MILVUS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f71fc2feb83b59dd — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2144 
            os.getenv(
                "MILVUS_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_MILVUS_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16834cdebd7bb828 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2150 
            os.getenv(
                "MILVUS_UPSERT_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_UPSERT_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fea4ed227989e086 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2156 
            os.getenv(
                "MILVUS_DELETE_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_DELETE_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aeec8deacc402a16 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2183 
            os.getenv(
                "MILVUS_MIGRATION_RETRY_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #464390ce8df39b90 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2189 
            os.getenv(
                "MILVUS_MIGRATION_RETRY_MAX_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_MAX_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #382ce0b0e84e8f77 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2211 
                os.getenv(
                    "MILVUS_MIGRATION_BATCH_SLEEP",
                    str(DEFAULT_MILVUS_MIGRATION_BATCH_SLEEP_SECONDS),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54427fe7ecc761ef — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:52 
GRAPH_BFS_MODE = os.getenv("MONGO_GRAPH_BFS_MODE", "bidirectional")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bebe576c9b898f1a — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:190 
        os.getenv(
            "MONGO_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_MONGO_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f021dfc4af7efaf9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:196 
        os.getenv(
            "MONGO_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f505760e17707ac2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:221 
        os.getenv(
            "MONGO_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be63f071579ca473 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:287 
                uri = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ea216670df886aa — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:287 
                uri = os.environ.get(
                    "MONGO_URI",
                    config.get(
                        "mongodb",
                        "uri",
                        fallback="mongodb://root:root@localhost:27017/",
                    ),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f262c37cc1b6f79d — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:295 
                database_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70378b5773207e2b — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:295 
                database_name = os.environ.get(
                    "MONGO_DATABASE",
                    config.get("mongodb", "database", fallback="LightRAG"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84a5453254cec91f — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:343 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #acdbc6d57337bc3e — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:592 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #337c4baf1429fca0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:1106 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #220071ea79dffbf0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:2886 
        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19109902ba686625 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:81 
        neo4j_workspace = os.environ.get("NEO4J_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ee60cd79175b948 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:174 
            URI = os.environ.get("NEO4J_URI", config.get("neo4j", "uri", fallback=None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cabb70050c4c23e7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:175 
            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b988969b7dfe4c83 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:175 
            USERNAME = os.environ.get(
                "NEO4J_USERNAME", config.get("neo4j", "username", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4050b2911aa10e7d — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:178 
            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2704b8c37cfd59cb — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:178 
            PASSWORD = os.environ.get(
                "NEO4J_PASSWORD", config.get("neo4j", "password", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36d90adbd857b587 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:182 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91052a86cfd995f0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:182 
                os.environ.get(
                    "NEO4J_MAX_CONNECTION_POOL_SIZE",
                    config.get("neo4j", "connection_pool_size", fallback=100),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67b1724d85495f1c — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:188 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efa2091fa5e64146 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:188 
                os.environ.get(
                    "NEO4J_CONNECTION_TIMEOUT",
                    config.get("neo4j", "connection_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4103382df0e1ac49 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:194 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e96aed5e49b1253e — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:194 
                os.environ.get(
                    "NEO4J_CONNECTION_ACQUISITION_TIMEOUT",
                    config.get(
                        "neo4j", "connection_acquisition_timeout", fallback=30.0
                    ),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11dbe5c301fddea3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:202 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35560e4a15079936 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:202 
                os.environ.get(
                    "NEO4J_MAX_TRANSACTION_RETRY_TIME",
                    config.get("neo4j", "max_transaction_retry_time", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cd6159ea9b290a5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:208 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7487aa4e9b4d57f9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:208 
                os.environ.get(
                    "NEO4J_MAX_CONNECTION_LIFETIME",
                    config.get("neo4j", "max_connection_lifetime", fallback=300.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18c133d1e9398713 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:214 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb52c1a3bb0f15f7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:214 
                os.environ.get(
                    "NEO4J_LIVENESS_CHECK_TIMEOUT",
                    config.get("neo4j", "liveness_check_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc4855bcc87e45c2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:219 
            KEEP_ALIVE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63fb9816a5d59899 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:219 
            KEEP_ALIVE = os.environ.get(
                "NEO4J_KEEP_ALIVE",
                config.get("neo4j", "keep_alive", fallback="true"),
            ).lower() in ("true", "1", "yes", "on")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #268c77611454ed3c — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:223 
            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abc519bd07803ed5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:223 
            DATABASE = os.environ.get(
                "NEO4J_DATABASE", re.sub(r"[^a-zA-Z0-9-]", "-", self.namespace)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #030aab790cea135e — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/opensearch_impl.py:60 
    return os.environ.get(key, config.get("opensearch", cfg_key, fallback=fallback))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87b8be2c9e5e70d9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/opensearch_impl.py:524 
    opensearch_workspace = os.environ.get("OPENSEARCH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09dd2915b1469344 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/opensearch_impl.py:1928 
        env_override = os.environ.get("OPENSEARCH_USE_PPL_GRAPHLOOKUP", "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2ccb4d5bf089240 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:184 
        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d278ccd4501d7c09 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:184 
        os.environ.get(
            "POSTGRES_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_PG_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #334b6eed72d3ce01 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:190 
        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76bdcde5b69a86bc — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:190 
        os.environ.get(
            "POSTGRES_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d2b9f2df34073e2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:196 
        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb522f115cec6788 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:196 
        os.environ.get(
            "POSTGRES_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8edd31920776b0b4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2314 
            "host": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0ab47f2dbdbe082 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2314 
            "host": os.environ.get(
                "POSTGRES_HOST",
                config.get("postgres", "host", fallback="localhost"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e5c0d514cc67b41 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2318 
            "port": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56dd9387b2025df4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2318 
            "port": os.environ.get(
                "POSTGRES_PORT", config.get("postgres", "port", fallback=5432)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f739c6de06c1c626 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2321 
            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54ef533dc57667af — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2321 
            "user": os.environ.get(
                "POSTGRES_USER", config.get("postgres", "user", fallback="postgres")
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #072e4edb70638112 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2324 
            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #011b297a89ea447a — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2324 
            "password": os.environ.get(
                "POSTGRES_PASSWORD",
                config.get("postgres", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d05e65120a4ea889 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2328 
            "database": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbf8c18be1ee9c3d — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2328 
            "database": os.environ.get(
                "POSTGRES_DATABASE",
                config.get("postgres", "database", fallback="postgres"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98b48e6aa3538cc6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2332 
            "workspace": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a32ac006a8a76c97 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2332 
            "workspace": os.environ.get(
                "POSTGRES_WORKSPACE",
                config.get("postgres", "workspace", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff664526afb78668 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2336 
            "max_connections": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #958d4fe080194d7a — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2336 
            "max_connections": os.environ.get(
                "POSTGRES_MAX_CONNECTIONS",
                config.get("postgres", "max_connections", fallback=50),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccacca0038fa442d — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2341 
            "ssl_mode": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50ca69ed82817663 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2341 
            "ssl_mode": os.environ.get(
                "POSTGRES_SSL_MODE",
                config.get("postgres", "ssl_mode", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67642b7fdcd2bcf7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2345 
            "ssl_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdf83d5dab50a6c5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2345 
            "ssl_cert": os.environ.get(
                "POSTGRES_SSL_CERT",
                config.get("postgres", "ssl_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #359667a1cfa81ebd — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2349 
            "ssl_key": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57d49c20cd395208 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2349 
            "ssl_key": os.environ.get(
                "POSTGRES_SSL_KEY",
                config.get("postgres", "ssl_key", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ed3562064fa5fb5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2353 
            "ssl_root_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a0ff4029fe34578 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2353 
            "ssl_root_cert": os.environ.get(
                "POSTGRES_SSL_ROOT_CERT",
                config.get("postgres", "ssl_root_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e55f8d354f7c154e — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2357 
            "ssl_crl": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5428844c5199144 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2357 
            "ssl_crl": os.environ.get(
                "POSTGRES_SSL_CRL",
                config.get("postgres", "ssl_crl", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc4946f44ade5ae3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2366 
            "vector_index_type": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e353213413f62a69 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2366 
            "vector_index_type": os.environ.get(
                "POSTGRES_VECTOR_INDEX_TYPE",
                config.get("postgres", "vector_index_type", fallback="HNSW"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fcafdb2822820fb2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2371 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa66ca05d8a41b45 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2371 
                os.environ.get(
                    "POSTGRES_HNSW_M",
                    config.get("postgres", "hnsw_m", fallback="16"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d56c7f568dc9279 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2377 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54d767feb48219aa — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2377 
                os.environ.get(
                    "POSTGRES_HNSW_EF",
                    config.get("postgres", "hnsw_ef", fallback="64"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #975d41543ac38b38 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2383 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #540f80428ac6129c — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2383 
                os.environ.get(
                    "POSTGRES_IVFFLAT_LISTS",
                    config.get("postgres", "ivfflat_lists", fallback="100"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #656ec2dbdf685cfd — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2388 
            "vchordrq_build_options": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a690f470fbad3e28 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2388 
            "vchordrq_build_options": os.environ.get(
                "POSTGRES_VCHORDRQ_BUILD_OPTIONS",
                config.get("postgres", "vchordrq_build_options", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38c9bb5fcb52aada — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2392 
            "vchordrq_probes": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6cd4bc3757ea0fde — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2392 
            "vchordrq_probes": os.environ.get(
                "POSTGRES_VCHORDRQ_PROBES",
                config.get("postgres", "vchordrq_probes", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5035c803e12f67d4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2397 
                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d094c02ff9d9289 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2397 
                os.environ.get(
                    "POSTGRES_VCHORDRQ_EPSILON",
                    config.get("postgres", "vchordrq_epsilon", fallback="1.9"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84650e0577550c36 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2403 
            "server_settings": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27c016c067cb23fe — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2403 
            "server_settings": os.environ.get(
                "POSTGRES_SERVER_SETTINGS",
                config.get("postgres", "server_options", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccdb4a28470c051f — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2407 
            "statement_cache_size": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c7dd4cdc15d36fe — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2407 
            "statement_cache_size": os.environ.get(
                "POSTGRES_STATEMENT_CACHE_SIZE",
                config.get("postgres", "statement_cache_size", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbc7095d644444a0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2415 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #478e19b3ef22d6c5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2415 
                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRIES",
                        config.get("postgres", "connection_retries", fallback=10),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0df13508b304d33 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2424 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8104b3d6d0e405bd — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2424 
                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF",
                        config.get(
                            "postgres", "connection_retry_backoff", fallback=3.0
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75ae44fc2cc95703 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2435 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f00a3d00bde87cd9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2435 
                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF_MAX",
                        config.get(
                            "postgres",
                            "connection_retry_backoff_max",
                            fallback=30.0,
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e48508366a619621 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2448 
                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fda84a7223bd0b0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2448 
                    os.environ.get(
                        "POSTGRES_POOL_CLOSE_TIMEOUT",
                        config.get("postgres", "pool_close_timeout", fallback=5.0),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5fdc593a64c134e — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:475 
        qdrant_workspace = os.environ.get("QDRANT_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a600d8544714cf3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:520 
            os.getenv(
                "QDRANT_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_QDRANT_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e9f59ccd79d3bbe — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:526 
            os.getenv(
                "QDRANT_UPSERT_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_UPSERT_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #480849b4ecb6f08c — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:532 
            os.getenv(
                "QDRANT_DELETE_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_DELETE_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c50b4db29525c3e0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:657 
                        url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce4c88b8a323d40e — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:657 
                        url=os.environ.get(
                            "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e2ce21dff6027e8 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:660 
                        api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7a865f5f3def776 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:660 
                        api_key=os.environ.get(
                            "QDRANT_API_KEY",
                            config.get("qdrant", "apikey", fallback=None),
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #713aeddcb9bee227 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:45 
MAX_CONNECTIONS = int(os.getenv("REDIS_MAX_CONNECTIONS", "200"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e30c593df2f8bea — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:46 
SOCKET_TIMEOUT = float(os.getenv("REDIS_SOCKET_TIMEOUT", "30.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9202d8c0aee80863 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:47 
SOCKET_CONNECT_TIMEOUT = float(os.getenv("REDIS_CONNECT_TIMEOUT", "10.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90adf59ad612cc17 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:48 
RETRY_ATTEMPTS = int(os.getenv("REDIS_RETRY_ATTEMPTS", "3"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81dca583dd877679 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:137 
        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e1a09700db61773 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:165 
        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0d0ae3874a537f2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:165 
        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7be135671a18fc8 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:534 
        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2784f34162049a0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:564 
        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #589e73ef134f77ee — Environment-variable access.
pkgs/python/[email protected]/lightrag/kg/redis_impl.py:564 
        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec42cb48b7cf6ff8 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:290 
    workspace: str = field(default_factory=lambda: os.getenv("WORKSPACE", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce20162832240231 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:484 
    embedding_batch_num: int = field(default=int(os.getenv("EMBEDDING_BATCH_NUM", 10)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4010bcc8ceb12746 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:488 
        default=int(os.getenv("EMBEDDING_FUNC_MAX_ASYNC", 8))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a79496763119b6b — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:506 
        default=int(os.getenv("EMBEDDING_TIMEOUT", DEFAULT_EMBEDDING_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cba516fe5e50a5b — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:530 
        default=int(os.getenv("SUMMARY_MAX_TOKENS", DEFAULT_SUMMARY_MAX_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6f3126bf606a589 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:535 
        default=int(os.getenv("SUMMARY_CONTEXT_SIZE", DEFAULT_SUMMARY_CONTEXT_SIZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9357051dbad2ab26 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:541 
            os.getenv("SUMMARY_LENGTH_RECOMMENDED", DEFAULT_SUMMARY_LENGTH_RECOMMENDED)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f42e76813464e7bf — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:548 
            os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d01d4312e006bc3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:557 
        default=int(os.getenv("LLM_TIMEOUT", DEFAULT_LLM_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2dd26abedd74f68 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:561 
        default=os.getenv("ENTITY_EXTRACTION_USE_JSON", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec4c191d8b856dad — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:577 
            os.getenv(
                "MAX_ASYNC_RERANK",
                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6c0d1a8739a9a8f — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:579 
                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #928d2b58a2b2d14d — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:588 
        default=int(os.getenv("RERANK_TIMEOUT", DEFAULT_RERANK_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f914bcc6d0298ac7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:625 
        default=int(os.getenv("MAX_PARALLEL_INSERT", DEFAULT_MAX_PARALLEL_INSERT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc51af8cd269316b — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:631 
            os.getenv(
                "MAX_PARALLEL_PARSE_NATIVE", str(DEFAULT_MAX_PARALLEL_PARSE_NATIVE)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e5f3789c2788544 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:638 
            os.getenv(
                "MAX_PARALLEL_PARSE_MINERU", str(DEFAULT_MAX_PARALLEL_PARSE_MINERU)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f9aaf3056b9b6c5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:645 
            os.getenv(
                "MAX_PARALLEL_PARSE_DOCLING", str(DEFAULT_MAX_PARALLEL_PARSE_DOCLING)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc7d117401240890 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:652 
            os.getenv("MAX_PARALLEL_ANALYZE", str(DEFAULT_MAX_PARALLEL_ANALYZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f76d36e04ad7b381 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:656 
        default=int(os.getenv("QUEUE_SIZE_PARSE", str(DEFAULT_QUEUE_SIZE_PARSE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45eaac0c316cfc91 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:659 
        default=int(os.getenv("QUEUE_SIZE_ANALYZE", str(DEFAULT_QUEUE_SIZE_ANALYZE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c08eec23b26b450 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:662 
        default=int(os.getenv("QUEUE_SIZE_INSERT", str(DEFAULT_QUEUE_SIZE_INSERT)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebe38c92d7cefba9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:736 
        default=float(os.getenv("COSINE_THRESHOLD", 0.2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fd3539711f1ac56 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:818 
                chunker_cfg["chunk_token_size"] = int(os.getenv("CHUNK_SIZE", 1200))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0393b77285320940 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:826 
            legacy_overlap_default = int(os.getenv("CHUNK_OVERLAP_SIZE", 100))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3db8291d6a39131a — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:855 
        p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81cc5913bf9b7f02 — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:877 
            size_raw = os.getenv(size_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6dd779ca67bd88f — Environment-variable access.
pkgs/python/[email protected]/lightrag/lightrag.py:969 
        if os.getenv("ENTITY_TYPES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #240cf764259026c5 — Filesystem access.
pkgs/python/[email protected]/lightrag/llm/_vision_utils.py:273 
        with open(path, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7167192f7ceabb0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/anthropic.py:78 
        api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #512ebc8faabc7a90 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/binding_options.py:379 
            env_raw = os.getenv(role_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #698613d448e0e610 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/binding_options.py:806 
        os.environ["OPENAI_LLM_REASONING"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eea601a7230d3604 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/binding_options.py:829 
            if "OPENAI_LLM_REASONING" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6349d157727e3921 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/binding_options.py:830 
                del os.environ["OPENAI_LLM_REASONING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c65b111d45f709c2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/gemini.py:98 
    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e283837fb1898b5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/gemini.py:102 
        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e62ae2e15136903c — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/gemini.py:104 
            location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85101f0f5e6367ee — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/gemini.py:134 
    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #709c5613824452e2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/gemini.py:139 
    key = api_key or os.getenv("LLM_BINDING_API_KEY") or os.getenv("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #719bab55be2ea3ca — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/hf.py:32 
os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a40a644ebe895c60 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/jina.py:120 
        os.environ["JINA_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1df44c919867d810 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/jina.py:122 
    if "JINA_API_KEY" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bd5e4b23f4b4d93 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/jina.py:128 
        "Authorization": f"Bearer {os.environ['JINA_API_KEY']}",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #459505c5aff25d5b — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/nvidia_openai.py:57 
        os.environ["OPENAI_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9a33bf6c5762de7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/ollama.py:147 
        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d07d63a6c5dc360 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/ollama.py:299 
        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19a5fd2aba96165a — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:48 
    langfuse_public_key = os.environ.get("LANGFUSE_PUBLIC_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed162a0a0ca35c47 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:49 
    langfuse_secret_key = os.environ.get("LANGFUSE_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9846d135c32625d1 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:110 
EMBEDDING_USE_BASE64: bool = os.getenv("EMBEDDING_USE_BASE64", "true").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a74f6c22f83629e4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:166 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a448262ed282cc8f — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:166 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(
                "LLM_BINDING_API_KEY"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a211e3ba2c1d3f3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:192 
            api_key = os.environ["OPENAI_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86ece4e5f0b60b98 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:198 
        dashscope_workspace_id = os.getenv("DASHSCOPE_WORKSPACE_ID", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92462784cb32f686 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:215 
            merged_configs["base_url"] = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb286663f3b3d56b — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:215 
            merged_configs["base_url"] = os.environ.get(
                "OPENAI_API_BASE", "https://api.openai.com/v1"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a0c232ead5cfab0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1070 
    deployment = os.getenv("AZURE_OPENAI_DEPLOYMENT") or model or os.getenv("LLM_MODEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0728c2ada5622ba8 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1072 
        base_url or os.getenv("AZURE_OPENAI_ENDPOINT") or os.getenv("LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5d022a3f03820bb — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1075 
        api_key or os.getenv("AZURE_OPENAI_API_KEY") or os.getenv("LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #204eb6476fc90d31 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1079 
        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ab34c943356acaf — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1080 
        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e3bead19354ff5b — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1120 
        os.getenv("LLM_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d71d2f66530461f — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1189 
        os.getenv("AZURE_EMBEDDING_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f90afe4df9c520c7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1191 
        or os.getenv("EMBEDDING_MODEL", "text-embedding-3-small")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80ce7e474bd15ee9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1195 
        or os.getenv("AZURE_EMBEDDING_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a409f71553f6d36 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1196 
        or os.getenv("EMBEDDING_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8579d1d4d81aafc9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1200 
        or os.getenv("AZURE_EMBEDDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2e588374c3af2c5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1201 
        or os.getenv("EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9db702928e6a837 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1205 
        or os.getenv("AZURE_EMBEDDING_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce0bf66e8cf81d27 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1206 
        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5fe6a30fa5e4953 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/openai.py:1207 
        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #077e22de84b0f039 — Environment-variable access.
pkgs/python/[email protected]/lightrag/llm/voyageai.py:98 
        api_key = os.environ.get("VOYAGE_API_KEY") or os.environ.get("VOYAGEAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1279b3b2b093f4a — Environment-variable access.
pkgs/python/[email protected]/lightrag/multimodal_context.py:697 
    raw = os.getenv("CHUNK_R_SEPARATORS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22bb7f6b98d3fa95 — Environment-variable access.
pkgs/python/[email protected]/lightrag/multimodal_context.py:762 
        raw = os.getenv(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa2a43d25bd12324 — Filesystem access.
pkgs/python/[email protected]/lightrag/multimodal_context.py:952 
            payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #512eaabaac60186c — Filesystem access.
pkgs/python/[email protected]/lightrag/multimodal_context.py:997 
            sidecar_path.write_text(
                json.dumps(payload, ensure_ascii=False, indent=2),
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bec8d8d7c33ea87 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/docx/parse_document.py:113 
        with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1f87f962b286ee7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:90 
    return os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fa030c052ca0a76 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:121 
        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37df1335fccad079 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:122 
        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bbad7139e30849a — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:123 
        base_url = os.getenv("GOOGLE_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72dbd60b8a41c1b7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:143 
        api_key = os.getenv("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6efc6859d104d01 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:164 
        project = os.getenv("GOOGLE_CLOUD_PROJECT", "unknown")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dbb5d6bf293bc4ae — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:165 
        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #658030b8bd41f4d9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:189 
    api_key = os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6b43772d4380ef4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:193 
    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9478fa55f0c6451 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/docx/utils.py:207 
    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #416aad8100f9c6d1 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/_common.py:70 
    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13afa599aea3f38e — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/_common.py:79 
    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f578508d7b50d7b — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/_common.py:93 
    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b5c12606b8eb60d — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/external/_manifest.py:132 
        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #739566f1fb219d19 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/external/_manifest.py:152 
    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2858729da2cdfdb7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:84 
    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef86e78dd0b42a17 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:138 
        "DOCLING_OCR_ENGINE": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb3d43d9f4d08b1a — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:139 
        "DOCLING_OCR_PRESET": os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54c992b8139ab627 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:140 
        "DOCLING_OCR_LANG": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d224bfeb3a85fcc9 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:177 
    cur_engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0514bdebe2c4424 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:97 
        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c85c4b3355283f28 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:105 
        self.ocr_engine = os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d77aa02754fd4433 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:106 
        self.ocr_preset = os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6bda9d0f5642255e — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:107 
        self.ocr_lang_raw = os.getenv("DOCLING_OCR_LANG", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8463afc794061b0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/docling/ir_builder.py:81 
        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57acaaee38fcb314 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/external/docling/ir_builder.py:109 
            doc = json.loads(main_json.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d7805863a518ba0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:109 
    mode = _normalize_api_mode(os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df3553c65afbea23 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:119 
    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b05a0f39de68966 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:128 
    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78b9c77ffe90ee81 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:144 
            os.getenv("MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2d0d49eb5647923 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:149 
        return os.getenv("MINERU_LOCAL_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b4909da9ee40a2c — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:220 
            overrides.get("page_range", os.getenv("MINERU_PAGE_RANGES", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57afe3a7e9cafd0a — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:225 
                    "language", os.getenv("MINERU_LANGUAGE", DEFAULT_MINERU_LANGUAGE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6e325049a53e634 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:234 
                    os.getenv(
                        "MINERU_LOCAL_PARSE_METHOD", DEFAULT_MINERU_LOCAL_PARSE_METHOD
                    ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0809dd2caa4d001 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:252 
                os.getenv("MINERU_MODEL_VERSION", DEFAULT_MINERU_MODEL_VERSION).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca48407ab4e986fd — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:263 
                os.getenv("MINERU_LOCAL_BACKEND", DEFAULT_MINERU_LOCAL_BACKEND).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a209f9dfe43daeb0 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:379 
    cur_engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e773dcc17b06d58 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:122 
            os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE).strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df11f88664b131f6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:131 
            os.getenv(
                "MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT
            ).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ac35a75bd29066e — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:137 
            os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b71a0d22e5ca391 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:139 
        self.api_token = os.getenv("MINERU_API_TOKEN", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35e48b069bd0d488 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:162 
        self.poll_interval = float(os.getenv("MINERU_POLL_INTERVAL_SECONDS", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cc836f37db791af — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:164 
        self.max_polls = int(os.getenv("MINERU_MAX_POLLS", "600"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #064af99b94864338 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:165 
        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60df4925dd2355b7 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:673 
            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ecf4cdd8cfe9610c — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:86 
        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c698297feb6ebcc6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:90 
        self.image_url_template = os.getenv("MINERU_IMAGE_URL_TEMPLATE", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4e7d112066c3e8e — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:95 
        raw = os.getenv("MINERU_BBOX_ATTRIBUTES", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e27f9f22d4bbf36b — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:139 
        content_list = json.loads(content_list_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c481d664c8703e18 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/manifest.py:126 
        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6565a402154297de — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/external/mineru/manifest.py:147 
    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41ab814f5dafd394 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/legacy/parser.py:47 
        pdf_password = os.getenv("PDF_DECRYPT_PASSWORD") or None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0eeb56d76022a1a2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:209 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5435215d30c50a6f — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:216 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9156634273327101 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:228 
    raw = os.getenv("NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ccb7e55d87fe4d3 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:456 
        data = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c57b40f30181c9a6 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:572 
            md_text = source.read_bytes().decode("utf-8-sig")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e1b845f57135817 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:583 
            source.read_bytes(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cb13865d119be5f — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:589 
        return text_file.read_bytes().decode("utf-8-sig"), text_file.parent

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d94b134b00cb25c6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:49 
        "max_bytes": os.getenv("NATIVE_MD_IMAGE_MAX_BYTES", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6faa14ee30da1f78 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:50 
        "max_svg_pixels": os.getenv("NATIVE_MD_IMAGE_MAX_SVG_PIXELS", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5164ac3984acd4c — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:51 
        "allowed_non_public_cidrs": os.getenv(
            "NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", ""
        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57cc8569df25275d — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:136 
            data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #080c35bcbf0d8a37 — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:194 
            tmp.write_text(
                json.dumps(manifest, ensure_ascii=False, indent=2), encoding="utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eac476148f388f5d — Filesystem access.
pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:214 
            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0c4e15ff91a8615 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/param_schema.py:410 
    return (os.getenv("MINERU_API_MODE", "") or "").strip().lower() != "official"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2dc8c2ed7f75a258 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/registry.py:45 
    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e7e8d23351a13d8 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/registry.py:47 
        return bool(os.getenv("MINERU_API_TOKEN", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bec2c4b61fd6ac0e — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/registry.py:49 
        return bool(os.getenv("MINERU_LOCAL_ENDPOINT", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f9ab80e4b52a1e8 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/registry.py:54 
    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d66727c2160d0675 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/registry.py:64 
    return lambda: bool(os.getenv(env_name, "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8092891ff0f4f2ec — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:317 
            p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb567fbed68401ad — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:328 
        if os.getenv("CHUNK_P_DROP_REFERENCES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35bdd1d7f7540b79 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:337 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcd006cb6fa334a6 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:347 
    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2e3539c6a40707d — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:398 
                os.getenv("CHUNK_R_SEPARATORS", json.dumps(list(DEFAULT_R_SEPARATORS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72686207810692db — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:402 
            "breakpoint_threshold_type": os.getenv(
                "CHUNK_V_BREAKPOINT_THRESHOLD_TYPE", "percentile"
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd07ab7c1deff78e — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:406 
                os.getenv("CHUNK_V_BREAKPOINT_THRESHOLD_AMOUNT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #493a6ccd3a5303db — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:408 
            "buffer_size": int(os.getenv("CHUNK_V_BUFFER_SIZE", "1")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61017a825bb41140 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:413 
            "sentence_split_regex": os.getenv(
                "CHUNK_V_SENTENCE_SPLIT_REGEX", DEFAULT_SENTENCE_SPLIT_REGEX
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c720956e7acbddd — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:423 
    f_overlap_raw = os.getenv("CHUNK_F_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b751ad5e2947545a — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:426 
    r_overlap_raw = os.getenv("CHUNK_R_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05af49a4b0031c96 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:429 
    p_overlap_raw = os.getenv("CHUNK_P_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44d01d91237b9ca4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:443 
    p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #337863171a12bed3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:454 
    f_size_raw = os.getenv("CHUNK_F_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fa6b8b338613e69 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:457 
    r_size_raw = os.getenv("CHUNK_R_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e79c9fdf90b4eab — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:460 
    v_size_raw = os.getenv("CHUNK_V_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3568406556144e98 — Environment-variable access.
pkgs/python/[email protected]/lightrag/parser/routing.py:918 
    return os.getenv("LIGHTRAG_PARSER", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #719c7729abf74410 — Filesystem access.
pkgs/python/[email protected]/lightrag/pipeline.py:3375 
            lines = block_file.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4202b8cb9e61f7e5 — Environment-variable access.
pkgs/python/[email protected]/lightrag/pipeline.py:3410 
                int(os.getenv("VLM_MAX_IMAGE_BYTES", str(5 * 1024 * 1024))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f295b278462e8c2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/pipeline.py:3414 
                int(os.getenv("VLM_MIN_IMAGE_PIXEL", str(DEFAULT_MM_IMAGE_MIN_PIXEL))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #deeddef296404269 — Filesystem access.
pkgs/python/[email protected]/lightrag/pipeline.py:3654 
                    raw = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c3aa87fb8562067 — Filesystem access.
pkgs/python/[email protected]/lightrag/pipeline.py:4040 
                    payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09bc09a7463dfda7 — Filesystem access.
pkgs/python/[email protected]/lightrag/pipeline.py:4168 
                    sidecar_path.write_text(
                        json.dumps(payload, ensure_ascii=False, indent=2),
                        encoding="utf-8",
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8ef010af0607c3a — Filesystem access.
pkgs/python/[email protected]/lightrag/pipeline.py:4358 
                payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c1a44ad373b20ef — Environment-variable access.
pkgs/python/[email protected]/lightrag/prompt.py:562 
    configured = os.getenv("PROMPT_DIR", "").strip() or _DEFAULT_PROMPT_DIR

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3b286131a2db9e5 — Filesystem access.
pkgs/python/[email protected]/lightrag/prompt.py:635 
        content = profile_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86a32ede1f0e890f — Environment-variable access.
pkgs/python/[email protected]/lightrag/rerank.py:418 
        api_key = os.getenv("COHERE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a49b2f78911de14a — Environment-variable access.
pkgs/python/[email protected]/lightrag/rerank.py:460 
        api_key = os.getenv("JINA_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12cb5c90bdcc12fc — Environment-variable access.
pkgs/python/[email protected]/lightrag/rerank.py:500 
        api_key = os.getenv("DASHSCOPE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8bd6d2beb650e1b — Filesystem access.
pkgs/python/[email protected]/lightrag/sidecar/writer.py:330 
    blocks_path.write_text(
        "\n".join([json.dumps(meta, ensure_ascii=False)] + blocks_lines) + "\n",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a966e7f162efed0 — Filesystem access.
pkgs/python/[email protected]/lightrag/sidecar/writer.py:339 
        tables_path.write_text(
            json.dumps(
                {"version": "1.0", "tables": tables},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3256c8d4056240d0 — Filesystem access.
pkgs/python/[email protected]/lightrag/sidecar/writer.py:349 
        drawings_path.write_text(
            json.dumps(
                {"version": "1.0", "drawings": drawings},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4b4b7b85b3f7fe5 — Filesystem access.
pkgs/python/[email protected]/lightrag/sidecar/writer.py:359 
        equations_path.write_text(
            json.dumps(
                {"version": "1.0", "equations": equations},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #ee851a62e72afc0c — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:141 
            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #924b9fdf053122d2 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:146 
        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #9c7cb53032b013a4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:198 
        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #eb3aa1fcd1e6ba70 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:266 
            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #5ccc034e8d824995 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/download_cache.py:34 
        os.environ["TIKTOKEN_CACHE_DIR"] = cache_dir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #ecbd60fb44c8b4d1 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 
        env_cache_dir = os.environ.get("TIKTOKEN_CACHE_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #285de48fab08f6b4 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:126 
            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #639e403e3980e6db — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:131 
        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #daafa3f725e72bdd — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:183 
        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #f980788ce8356690 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:219 
                has_env = all(var in os.environ for var in required_vars)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #4b09e4f7fdfe59fe — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:279 
            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #dbb72d140e66517f — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1090 
                    if "REDIS_URI" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #aeaa2ba92adede53 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1098 
                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #94ed1cb5db976e22 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1108 
                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #7f82b2e8c8916a06 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1118 
                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #4bf86c4f7f63964d — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:154 
                url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #480dc1ddf57fbe50 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:154 
                url=os.environ.get(
                    "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #099ed48bcbff7e6b — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:157 
                api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #1946dd9b92e0faba — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:157 
                api_key=os.environ.get(
                    "QDRANT_API_KEY",
                    config.get("qdrant", "apikey", fallback=None),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #8b3b7ec589f12a1a — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:584 
            "graph": os.getenv("LIGHTRAG_GRAPH_STORAGE", "NetworkXStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #eb232e9b5e3fff43 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:585 
            "vector": os.getenv("LIGHTRAG_VECTOR_STORAGE", "NanoVectorDBStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #aba8de8a48214f23 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:586 
            "kv": os.getenv("LIGHTRAG_KV_STORAGE", "JsonKVStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #ab6a5647856e4353 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:592 
        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #7871ecdff8a741c7 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:625 
            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #1453898dc76eda65 — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:654 
                    os.getenv("TIKTOKEN_MODEL_NAME", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #09a605a66b9f735f — Environment-variable access.
pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:666 
        self.workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4867cc93486da25 — Environment-variable access.
pkgs/python/[email protected]/lightrag/utils.py:269 
    value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aac4161cfce4009d — Environment-variable access.
pkgs/python/[email protected]/lightrag/utils.py:315 
VERBOSE_DEBUG = os.getenv("VERBOSE", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9013ae7deae3f1e — Environment-variable access.
pkgs/python/[email protected]/lightrag/utils.py:317 
    os.getenv("LIGHTRAG_PERFORMANCE_TIMING_LOGS", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb44c470e83232f3 — Environment-variable access.
pkgs/python/[email protected]/lightrag/utils.py:442 
            log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7270455c6a7f97c3 — Filesystem access.
pkgs/python/[email protected]/lightrag/utils.py:2332 
    with open(file_name, encoding="utf-8-sig") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88248f3ebb7568e2 — Filesystem access.
pkgs/python/[email protected]/lightrag/utils.py:2450 
            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b042d2de54f79276 — Filesystem access.
pkgs/python/[email protected]/lightrag/utils.py:2457 
            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f6494693329e087 — Filesystem access.
pkgs/python/[email protected]/lightrag/utils.py:3158 
        with open(output_path, "w", newline="", encoding="utf-8") as csvfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdde17e73eb1f363 — Filesystem access.
pkgs/python/[email protected]/lightrag/utils.py:3208 
        with open(output_path, "w", encoding="utf-8") as mdfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #554aee99b7c27020 — Filesystem access.
pkgs/python/[email protected]/lightrag/utils.py:3270 
        with open(output_path, "w", encoding="utf-8") as txtfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9206e326ad990116 — Environment-variable access.
pkgs/python/[email protected]/lightrag/utils.py:3982 
    missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3fd9a884ecd6823 — Environment-variable access.
pkgs/python/[email protected]/lightrag/utils_pipeline.py:541 
    input_dir = os.getenv("INPUT_DIR", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

python dependency
high pii_flow dependency Excluded from app score #07b4d0ae7c5d97b5 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:278 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/openai/lib/azure.py:239 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/openai/lib/azure.py:278 
        self._azure_endpoint = httpx.URL(azure_endpoint) if azure_endpoint else None

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
high pii_flow dependency Excluded from app score #f7c2352a06711b06 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/python/[email protected]/src/openai/lib/azure.py:602 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/openai/lib/azure.py:563 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/src/openai/lib/azure.py:602 
        self._azure_endpoint = httpx.URL(azure_endpoint) if azure_endpoint else None

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 63 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #d36d670895f519f3 — Filesystem access.
pkgs/python/[email protected]/examples/image_stream.py:30 
            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8f0dee504910e05d — Filesystem access.
pkgs/python/[email protected]/examples/image_stream.py:41 
            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6e016eae45c91067 — Environment-variable access.
pkgs/python/[email protected]/examples/realtime/azure_realtime.py:31 
    endpoint = os.environ["AZURE_OPENAI_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7bb800aa5732237d — Environment-variable access.
pkgs/python/[email protected]/examples/realtime/azure_realtime.py:37 
    deployment_name = os.environ["AZURE_OPENAI_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #00cd61a895a837c6 — Filesystem access.
pkgs/python/[email protected]/examples/uploads.py:30 
    data = file.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e06b6d5d77ea857f — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:158 
api_type: _ApiType | None = _t.cast(_ApiType, _os.environ.get("OPENAI_API_TYPE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f5e1d94d0de105a — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:160 
api_version: str | None = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b8f265f256210c7 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:162 
azure_endpoint: str | None = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d5d1467207fb5c4 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:164 
azure_ad_token: str | None = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d89ae013f2bcfc1 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:338 
    return _os.environ.get("OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30c971d75b8488e4 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:342 
    return azure_endpoint is not None or _os.environ.get("AZURE_OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4736ff662deb2c16 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:347 
        _os.environ.get("AZURE_OPENAI_AD_TOKEN") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53c2f39179e2786c — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:363 
            azure_endpoint = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d051db04d99e6b19 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:366 
            azure_ad_token = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f0c02e2730be119 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:369 
            api_version = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #936e05b6d2227ccd — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:379 
            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1f0ac8f10f11be2 — Environment-variable access.
pkgs/python/[email protected]/src/openai/__init__.py:379 
            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(
                "AZURE_OPENAI_API_KEY"
            ) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb39696a19ffdaaa — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:209 
                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #016b6bfa15b43e28 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:219 
            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2858872c7c07fe01 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:235 
            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #282eed62e4ead7aa — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:239 
            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9c3d1f1f85fc5a7 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:243 
            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a836487403019af4 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:251 
            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #354568a40dc90bb8 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:255 
        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3dc4d155d8cb4e4 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:805 
                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51577f403643b0c5 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:815 
            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78a354af5a723d37 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:831 
            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9743a5fba96b6a6 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:835 
            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52f28d5c681a8c49 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:839 
            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9872994f49bc369 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:847 
            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13e42a6dbb80c160 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_client.py:851 
        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f954a413468f85f — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:69 
            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #105f44be97d160b8 — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:81 
        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #019af5e4f143144d — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:111 
            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f2b6b12b8146d0f — Filesystem access.
pkgs/python/[email protected]/src/openai/_files.py:123 
        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6583e6246c629d7 — Filesystem access.
pkgs/python/[email protected]/src/openai/_legacy_response.py:441 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #659a3c278b348685 — Filesystem access.
pkgs/python/[email protected]/src/openai/_legacy_response.py:454 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc9798b96247eb61 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_models.py:129 
            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #989f789783939f9f — Filesystem access.
pkgs/python/[email protected]/src/openai/_response.py:513 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #818d0bb9f539a3c8 — Filesystem access.
pkgs/python/[email protected]/src/openai/_response.py:555 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b48f9b3759ef14e7 — Environment-variable access.
pkgs/python/[email protected]/src/openai/_utils/_logs.py:23 
    env = os.environ.get("OPENAI_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89772a3fd0597bc3 — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_transform.py:248 
            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f16d8ddacaeaac5 — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_transform.py:414 
            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba24dd31e2c13f36 — Filesystem access.
pkgs/python/[email protected]/src/openai/_utils/_utils.py:383 
    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #038fc853628550cf — Filesystem access.
pkgs/python/[email protected]/src/openai/auth/_workload.py:58 
            with open(token_file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff1efc3cac2d4377 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/_bedrock_auth.py:172 
        region = os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cac5e3819ccb1860 — Filesystem access.
pkgs/python/[email protected]/src/openai/lib/_validators.py:485 
                with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13c17687d6e392a5 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:214 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b142e71c228a4331 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:217 
            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e6812bf97fcfdad — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:225 
            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f55a0d07837c65a — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:239 
                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e34ec8806086f455 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:538 
            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1846e5c406bcb2c — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:541 
            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b6c89e16ab34249 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:549 
            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #525edb1180d29cb9 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/azure.py:563 
                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c22f9e0a1146b0e — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:70 
    configured = region or os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c82caad12917b2e — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:80 
    environment_base_url = os.environ.get("AWS_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fdf58b2db695b13 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:105 
    token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54c7809acd4b60d0 — Environment-variable access.
pkgs/python/[email protected]/src/openai/lib/bedrock.py:150 
    environment_token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be6e11ef7a266384 — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:248 
            token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67d4fa60c51be09a — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:331 
            os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97aaf1bce609aa92 — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:338 
        environment_base_url = _normalize_optional_string(os.environ.get("AWS_BEDROCK_BASE_URL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ac514bd138aaf92 — Environment-variable access.
pkgs/python/[email protected]/src/openai/providers/bedrock.py:391 
        and bool(os.environ.get("AWS_BEARER_TOKEN_BEDROCK"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langfuse

python dependency
medium telemetry dependency Excluded from app score #402602d1a12abcdb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:32 
from opentelemetry import context as otel_context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #592635605d6c005c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:33 
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b5d3e9fd8ffbe140 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:34 
from opentelemetry.sdk.trace import ReadableSpan, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #96a305d202b6f549 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:35 
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5f663c320d9b89d4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:36 
from opentelemetry.sdk.trace.id_generator import IdGenerator, RandomIdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3a78f62eeee998c3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/client.py:37 
from opentelemetry.util._decorator import (
    _AgnosticContextManager,
    _agnosticcontextmanager,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c8c2827e7c92f58f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/observe.py:22 
from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8a7d8a9100b5e1c9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:23 
from opentelemetry import (
    baggage,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #fcfdb3617f9055b6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:26 
from opentelemetry import (
    baggage as otel_baggage_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #cac88129c3a5a39a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:29 
from opentelemetry import (
    context as otel_context_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #157626ab786a0a22 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:32 
from opentelemetry import (
    trace as otel_trace_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7c0aba0de027492d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:35 
from opentelemetry.context import _RUNTIME_CONTEXT

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0f71795c34e5a5da — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/propagation.py:36 
from opentelemetry.util._decorator import (
    _AgnosticContextManager,
    _agnosticcontextmanager,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4ae13444ced6edbb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:27 
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a9a8ae5efee53053 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:28 
from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #358d0a0b66c45f95 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:29 
from opentelemetry.sdk.trace import ReadableSpan, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f6311e9df2f31517 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:30 
from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #5faddf6d753b0181 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:31 
from opentelemetry.sdk.trace.id_generator import IdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #db844fdb55938034 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:32 
from opentelemetry.sdk.trace.sampling import Decision, TraceIdRatioBased

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #cc4edf798cbc1bde — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:33 
from opentelemetry.trace import Tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #caa57fdfb3dc5c1a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span.py:30 
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3a93b453c53ba55a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span.py:31 
from opentelemetry.trace.status import Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #3e6c347949c6fad8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span.py:32 
from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0f185b636f961a03 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:7 
from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #740ee1dac1c0a5ce — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:8 
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8d974ff6409a4d47 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:9 
from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #35dcc7784a483abd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:10 
from opentelemetry.sdk.util import BoundedList

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #afa6451799bfb2de — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:11 
from opentelemetry.trace import format_span_id, format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #26661a859dceb219 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_exporter.py:12 
from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #269263eba7e221e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_filter.py:7 
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #b2325539794ce35a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:19 
from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c06718695ded66f0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:20 
from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #07dce10067daf828 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:21 
from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #9af5d0ab51357125 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:22 
from opentelemetry.sdk.trace import ReadableSpan, Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f253a508daeb3af5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:23 
from opentelemetry.sdk.trace.export import BatchSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #0ec249ff6885b15f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:24 
from opentelemetry.trace import format_span_id, format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #6fd2665eddc737d8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/utils.py:14 
from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #8a2f18c150e7a951 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/utils.py:15 
from opentelemetry.sdk import util

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #446c2363049fd47d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/_client/utils.py:16 
from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #a4abf56ac72c1317 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/langchain/CallbackHandler.py:19 
from opentelemetry import context, trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f6f55d4c67f60960 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/langchain/CallbackHandler.py:20 
from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #eff78ab0fe16ce74 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/langfuse/types.py:33 
from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 32 low-confidence finding(s)
low env_fs dependency Excluded from app score #5c69b7a4491cf5c2 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:317 
            or os.environ.get(LANGFUSE_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73469e3f785704e4 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:319 
            or os.environ.get(LANGFUSE_HOST, "https://cloud.langfuse.com")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0fbf6c476eaa3b1 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:322 
            str, os.environ.get(LANGFUSE_TRACING_ENVIRONMENT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8614a43e8b0d6aa4 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:326 
            or os.environ.get(LANGFUSE_RELEASE, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09cc241eb71bc15a — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:330 
        sample_rate = sample_rate or float(os.environ.get(LANGFUSE_SAMPLE_RATE, 1.0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91a3c31799989c8d — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:336 
        timeout = timeout or int(os.environ.get(LANGFUSE_TIMEOUT, 5))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32f24a16b85695c0 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:340 
            and os.environ.get(LANGFUSE_TRACING_ENABLED, "true").lower() != "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5286f98150fd224b — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:348 
            debug if debug else (os.getenv(LANGFUSE_DEBUG, "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb5f247141b35f61 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:356 
        public_key = public_key or os.environ.get(LANGFUSE_PUBLIC_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94f6757a49ea10c2 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:365 
        secret_key = secret_key or os.environ.get(LANGFUSE_SECRET_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7cc68e5d351336e — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/client.py:374 
        if os.environ.get("OTEL_SDK_DISABLED", "false").lower() == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72be9667649988ca — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/observe.py:172 
        function_io_capture_enabled = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72af435bc29f2f5c — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/observe.py:172 
        function_io_capture_enabled = os.environ.get(
            LANGFUSE_OBSERVE_DECORATOR_IO_CAPTURE_ENABLED, "True"
        ).lower() not in ("false", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f9f7d2df8b96fa2 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:231 
        self._media_upload_enabled = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b486a91c33d8609 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:231 
        self._media_upload_enabled = os.environ.get(
            LANGFUSE_MEDIA_UPLOAD_ENABLED, "True"
        ).lower() not in ("false", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d03b60fde7d07db6 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:236 
            int(os.getenv(LANGFUSE_MEDIA_UPLOAD_THREAD_COUNT, 1)), 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e563142bd7dcbf4e — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:434 
            os.environ["no_proxy"] = "*"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e17d35e2c8d9c69d — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:435 
            os.environ["NO_PROXY"] = "*"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9d3a0fc30a25b34 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:631 
    environment = environment or os.environ.get(LANGFUSE_TRACING_ENVIRONMENT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6201f2aeab2ec5f9 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/resource_manager.py:632 
    release = release or os.environ.get(LANGFUSE_RELEASE) or get_common_release_envs()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9565f7501424c43 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:89 
        env_flush_at = os.environ.get(LANGFUSE_FLUSH_AT, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d23c3d6ae08ddbab — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:93 
        env_flush_interval = os.environ.get(LANGFUSE_FLUSH_INTERVAL, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19476cb4ca9961a3 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_client/span_processor.py:113 
            traces_export_path = os.environ.get(LANGFUSE_OTEL_TRACES_EXPORT_PATH, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0905f9870d22afdb — Environment-variable access.
pkgs/python/[email protected]/langfuse/_task_manager/media_manager.py:45 
        self._enabled = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #837c8b042f68609b — Environment-variable access.
pkgs/python/[email protected]/langfuse/_task_manager/media_manager.py:45 
        self._enabled = os.environ.get(
            LANGFUSE_MEDIA_UPLOAD_ENABLED, "True"
        ).lower() not in ("false", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5bbb074ec0a36fd — Environment-variable access.
pkgs/python/[email protected]/langfuse/_task_manager/score_ingestion_consumer.py:18 
MAX_EVENT_SIZE_BYTES = int(os.environ.get("LANGFUSE_MAX_EVENT_SIZE_BYTES", 1_000_000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2de1a82a125cf441 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_task_manager/score_ingestion_consumer.py:19 
MAX_BATCH_SIZE_BYTES = int(os.environ.get("LANGFUSE_MAX_BATCH_SIZE_BYTES", 2_500_000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcf6cbe96feae9b7 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_utils/environment.py:32 
        if env in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85ee53911ca8b5c9 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_utils/environment.py:33 
            return os.environ[env]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2afcc518f5153672 — Environment-variable access.
pkgs/python/[email protected]/langfuse/_utils/prompt_cache.py:17 
    os.getenv(LANGFUSE_PROMPT_CACHE_DEFAULT_TTL_SECONDS, 60)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bebf78471e71e2e1 — Filesystem access.
pkgs/python/[email protected]/langfuse/media.py:178 
            with open(file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c18d917fa92dcc35 — Environment-variable access.
pkgs/python/[email protected]/langfuse/openai.py:1213 
    if os.environ.get(LANGFUSE_OPENAI_SKIP_RAW_RESPONSES, "False").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redis

python dependency
medium telemetry dependency Excluded from app score #f519e56aa15e87c4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/asyncio/observability/recorder.py:247 
        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #577e8201ec0fb694 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/metrics.py:37 
    from opentelemetry.metrics import Meter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #df2878d4cc405af0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/providers.py:32 
    from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #2e12f74e360e2225 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/providers.py:76 
            from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ec6baea805695fdd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/providers.py:77 
            from opentelemetry.metrics import NoOpMeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4aea11b856f22e2e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/recorder.py:242 
        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #c8dd09f13cce5c87 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/recorder.py:727 
    from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #75226213355ff186 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/python/[email protected]/redis/observability/registry.py:8 
        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #128810656d133c86 — Filesystem access.
pkgs/python/[email protected]/redis/commands/json/__init__.py:303 
            with open(fp) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac8c7e81da4ba131 — Filesystem access.
pkgs/python/[email protected]/redis/commands/json/commands.py:650 
        with open(file_name) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

PyJWT

python dependency
expand_more 4 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #2fc44e7fbea62557 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:11 
    with open(os.path.join(here, *parts), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6007f30a5566897c — Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:97 
os.environ["SPHINX_BUILD"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0275b19bbae09cad — Environment-variable access.
pkgs/python/[email protected]/jwt/algorithms.py:102 
    if TYPE_CHECKING or bool(os.getenv("SPHINX_BUILD", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bb210681413cd57 — Environment-variable access.
pkgs/python/[email protected]/jwt/api_jwt.py:25 
if TYPE_CHECKING or bool(os.getenv("SPHINX_BUILD", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

PyYAML

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #adf70c505d5d9f2f — Environment-variable access.
pkgs/python/[email protected]/setup.py:72 
os.environ['SETUPTOOLS_USE_DISTUTILS'] = 'local'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de14e7791ef58f20 — Environment-variable access.
pkgs/python/[email protected]/setup.py:81 
if 'sdist' in sys.argv or os.environ.get('PYYAML_FORCE_CYTHON') == '1':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c32b59cb002eddb7 — Environment-variable access.
pkgs/python/[email protected]/setup.py:160 
            with_ext = getattr(self, ext.attr_name) or os.environ.get('PYYAML_FORCE_{0}'.format(ext.feature_name.upper()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

aioboto3

python dependency
expand_more 6 low-confidence finding(s)
low egress dependency Excluded from app score #8f3c0fcecf3561ac — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/resources/make_pr.py:38 
resp = requests.get('https://pypi.org/pypi/aiobotocore/json').json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #b348767590366fb1 — Environment-variable access.
pkgs/python/[email protected]/resources/make_pr.py:54 
g = Github(os.environ['GITHUB_TOKEN'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #935423a2e7ad71c5 — Filesystem access.
pkgs/python/[email protected]/resources/make_pr.py:83 
with open('setup.py', 'r') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa15278933d9a689 — Filesystem access.
pkgs/python/[email protected]/resources/make_pr.py:85 
with open('setup.py', 'w') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35a1787c1460dbb6 — Filesystem access.
pkgs/python/[email protected]/resources/make_pr.py:92 
with open('Pipfile', 'r') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4025318f1578347a — Filesystem access.
pkgs/python/[email protected]/resources/make_pr.py:98 
with open('Pipfile', 'w') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

aiohttp

python dependency
expand_more 19 low-confidence finding(s)
low env_fs dependency Excluded from app score #b96e76b9fd79fa09 — Filesystem access.
pkgs/python/[email protected]/aiohttp/cookiejar.py:207 
        with open(
            file_path,
            mode="w",
            encoding="utf-8",
            opener=lambda path, flags: os.open(path, flags, 0o600),
        ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e05f781a6a81ca7 — Environment-variable access.
pkgs/python/[email protected]/aiohttp/helpers.py:73 
NO_EXTENSIONS = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42856fc7bf7bfcd0 — Environment-variable access.
pkgs/python/[email protected]/aiohttp/helpers.py:82 
    not sys.flags.ignore_environment and bool(os.environ.get("PYTHONASYNCIODEBUG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea94da05b366955b — Environment-variable access.
pkgs/python/[email protected]/aiohttp/helpers.py:228 
    netrc_env = os.environ.get("NETRC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #270857c26c7db2ac — Environment-variable access.
pkgs/python/[email protected]/aiohttp/web_fileresponse.py:50 
NOSENDFILE: Final[bool] = bool(os.environ.get("AIOHTTP_NOSENDFILE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #97d0e1fdd0caf66a — Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:21 
    os.getenv("READTHEDOCS", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #723c2b5b53bb6fbc — Environment-variable access.
pkgs/python/[email protected]/docs/conf.py:22 
    and os.environ["READTHEDOCS_VERSION_TYPE"] == "tag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #df66354e39b7b4ff — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:31 
with open(_version_path, encoding="latin1") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8bfa83a51d2e84d9 — Filesystem access.
pkgs/python/[email protected]/examples/web_ws.py:20 
        with open(WS_FILE, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #789f77b000c1b789 — Filesystem access.
pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:12 
data = tomllib.loads(Path("pyproject.toml").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9d5f6d189051341 — Filesystem access.
pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:19 
with open(Path("requirements", "runtime-deps.in"), "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d00184a8238e5848 — Environment-variable access.
pkgs/python/[email protected]/setup.py:13 
    os.environ.get("AIOHTTP_USE_SYSTEM_DEPS", os.environ.get("USE_SYSTEM_DEPS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf70ae8c381ae4c6 — Environment-variable access.
pkgs/python/[email protected]/setup.py:15 
NO_EXTENSIONS: bool = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a4aaa1d250dcfea — Environment-variable access.
pkgs/python/[email protected]/setup.py:16 
CYTHON_TRACING: bool = bool(os.environ.get("AIOHTTP_CYTHON_TRACE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3537fab73e5e0f05 — Filesystem access.
pkgs/python/[email protected]/tools/check_sum.py:30 
        hasher.update(full_src.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5cdcf26dbec6352f — Filesystem access.
pkgs/python/[email protected]/tools/check_sum.py:37 
        dst_hash = dst.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #85b5b0e7bb934b47 — Filesystem access.
pkgs/python/[email protected]/tools/check_sum.py:41 
        dst.write_text(src_hash)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8b1b357fb13ffc58 — Filesystem access.
pkgs/python/[email protected]/tools/cleanup_changes.py:30 
    changes = (root / "CHANGES.rst").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #359cca93100b2f72 — Filesystem access.
pkgs/python/[email protected]/tools/gen.py:16 
    code = compile(hdrs_file.read_text(), str(hdrs_file), "exec")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ascii_colors

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #f8f6637219ee93df — Filesystem access.
pkgs/python/[email protected]/ascii_colors/handlers.py:83 
            self._stream = open(self.filename, self.mode, encoding=self.encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

asyncpg

python dependency
expand_more 52 low-confidence finding(s)
low env_fs dependency Excluded from app score #5e0fa5312eb31d1e — Environment-variable access.
pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:102 
        if os.environ.get('USE_UVLOOP'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #814077bd1a14578e — Environment-variable access.
pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:246 
        pg_host = os.environ.get('PGHOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a67df63a1440b8ef — Environment-variable access.
pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:352 
        if not os.environ.get('PGHOST') and not kwargs.get('dsn'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4472772030337884 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:509 
        if not os.environ.get('PGHOST') and not kwargs.get('dsn'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4c545320197b859 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:64 
    if _system == 'Windows' and os.environ.get("GITHUB_ACTIONS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #203082be44c7ca66 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:82 
            os.environ.get('PGINSTALLATION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f84730a78c748df — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:83 
            or os.environ.get('PGBIN')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bacf553c67caa8ee — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:215 
            if os.getenv('ASYNCPG_DEBUG_SERVER'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2814337f0472854e — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:245 
            if os.getenv('ASYNCPG_DEBUG_SERVER'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fa2562cf8d149f6 — Filesystem access.
pkgs/python/[email protected]/asyncpg/cluster.py:377 
            with open(pg_hba, 'w'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ea7ce4aef2737f1 — Filesystem access.
pkgs/python/[email protected]/asyncpg/cluster.py:412 
            with open(pg_hba, 'a') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3292f935843bbace — Filesystem access.
pkgs/python/[email protected]/asyncpg/cluster.py:466 
            with open(pidfile, 'rt') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed77b640c33f4f4f — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:566 
                os.environ.get('PGINSTALLATION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d33b4803d5b69978 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:567 
                or os.environ.get('PGBIN')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f37086151e0bfc3d — Environment-variable access.
pkgs/python/[email protected]/asyncpg/cluster.py:573 
                pathenv = os.environ.get('PATH').split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb8a3f3f45339043 — Filesystem access.
pkgs/python/[email protected]/asyncpg/cluster.py:671 
            with open(os.path.join(self._data_dir, 'recovery.conf'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #245902ba35abf6f1 — Filesystem access.
pkgs/python/[email protected]/asyncpg/cluster.py:680 
            f = open(os.path.join(self._data_dir, 'standby.signal'), 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a0e235c89f30d02 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:201 
        portspec = os.environ.get('PGPORT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24aa498e4ed2a419 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:306 
            connection_service_file = os.getenv('PGSERVICEFILE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f5c7c3ea75d745a — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:555 
        service = os.environ.get('PGSERVICE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #844d52e9b7ab3a99 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:557 
        hostspec = os.environ.get('PGHOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa79ba1e52bc4b62 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:577 
        portspec = os.environ.get('PGPORT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #156d875f36acd572 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:595 
        user = os.getenv('PGUSER')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c67848ab63b02d1 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:600 
        password = os.getenv('PGPASSWORD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a1f281dd17acf27 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:603 
        database = os.getenv('PGDATABASE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfd425d06a7370d9 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:618 
            passfile = os.getenv('PGPASSFILE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd81586414ad96af — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:653 
        ssl = os.getenv('PGSSLMODE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7319bf7e16b59368 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:664 
            sslnegotiation = os.environ.get("PGSSLNEGOTIATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9932a346a47256ef — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:699 
                    sslrootcert = os.getenv('PGSSLROOTCERT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3be9085812f9ddd7 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:745 
                    sslcrl = os.getenv('PGSSLCRL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a74f2abd61eb3cf — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:764 
                sslkey = os.getenv('PGSSLKEY')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03261c46bb4dd2c9 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:772 
                sslcert = os.getenv('PGSSLCERT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d17d73bfb3e3e7b — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:791 
                keylogfile = os.environ.get('SSLKEYLOGFILE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bf8d51438c6c8dc — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:796 
                ssl_min_protocol_version = os.getenv('PGSSLMINPROTOCOLVERSION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c41ebfa601f621d3 — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:805 
                ssl_max_protocol_version = os.getenv('PGSSLMAXPROTOCOLVERSION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7a483408c47d76c — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:826 
        target_session_attrs = os.getenv(
            "PGTARGETSESSIONATTRS", SessionAttribute.any
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54244a5afae0816a — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:841 
        krbsrvname = os.getenv('PGKRBSRVNAME')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14cc73a85f4d349a — Environment-variable access.
pkgs/python/[email protected]/asyncpg/connect_utils.py:844 
        gsslib = os.getenv('PGGSSLIB')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9da16016161e6616 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:11 
with open(version_file, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2fcb18f3fdfe24d — Filesystem access.
pkgs/python/[email protected]/setup.py:40 
with open(str(_ROOT / 'README.rst')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6681dc7093d38230 — Filesystem access.
pkgs/python/[email protected]/setup.py:44 
with open(str(_ROOT / 'asyncpg' / '_version.py')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1203567332e7b060 — Environment-variable access.
pkgs/python/[email protected]/setup.py:60 
        v = os.environ.get('PATH')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa3450d0042e61c0 — Filesystem access.
pkgs/python/[email protected]/setup.py:82 
        with open(str(filename)) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea3a5308a5969469 — Filesystem access.
pkgs/python/[email protected]/setup.py:89 
        with open(str(filename), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34a2d80f90ce3355 — Environment-variable access.
pkgs/python/[email protected]/setup.py:137 
        if os.environ.get('ASYNCPG_DEBUG'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4680254a747efea0 — Environment-variable access.
pkgs/python/[email protected]/setup.py:159 
            self.cython_always = bool(os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a9f1249b0f64403 — Environment-variable access.
pkgs/python/[email protected]/setup.py:159 
            self.cython_always = bool(os.environ.get(
                "ASYNCPG_BUILD_CYTHON_ALWAYS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92c8a2c4463583e7 — Environment-variable access.
pkgs/python/[email protected]/setup.py:163 
            self.cython_annotate = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80e42ff7d02d4516 — Environment-variable access.
pkgs/python/[email protected]/setup.py:163 
            self.cython_annotate = os.environ.get(
                "ASYNCPG_BUILD_CYTHON_ANNOTATE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90a4d11d0347e84f — Environment-variable access.
pkgs/python/[email protected]/setup.py:167 
            self.cython_directives = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9b5ec199280d371 — Environment-variable access.
pkgs/python/[email protected]/setup.py:167 
            self.cython_directives = os.environ.get(
                "ASYNCPG_BUILD_CYTHON_DIRECTIVES")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #580339fcd6bd912f — Environment-variable access.
pkgs/python/[email protected]/setup.py:239 
    or os.environ.get("ASYNCPG_BUILD_CYTHON_ALWAYS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cairosvg

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #93530b80c2fa4f06 — Filesystem access.
pkgs/python/[email protected]/cairosvg/__init__.py:21 
VERSION = __version__ = (ROOT / 'VERSION').read_text().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be4ce5c540c2333e — Filesystem access.
pkgs/python/[email protected]/cairosvg/test_api.py:42 
    with open(filename, 'rb') as file_object:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33b48de8b1a43a92 — Filesystem access.
pkgs/python/[email protected]/cairosvg/test_api.py:140 
            sys.stdin = open(input_, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

configparser

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #14d228bf9f3111a6 — Filesystem access.
pkgs/python/[email protected]/backports/configparser/__init__.py:813 
                with open(filename, encoding=encoding) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cryptography

python dependency
expand_more 22 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #63106145f51b3e5f — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:88 
with open(os.path.join(base_dir, "src", "cryptography", "__about__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #568af029d4b7b52c — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/aes-192-gcm-siv/generate_aes192gcmsiv.py:52 
    with open(filename) as vector_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8254f2e5c92a5596 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/aes-192-gcm-siv/generate_aes192gcmsiv.py:81 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4fce82e466270a07 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/arc4/generate_arc4.py:92 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a92090a39693f9af — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/cast5/generate_cast5.py:28 
    with open(filename) as vector_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3cac5434d38cc9a9 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/cast5/generate_cast5.py:52 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fbd20e31b23fa3e9 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/hkdf/generate_hkdf.py:34 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d488b75505cc6ecc — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/idea/generate_idea.py:18 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #74625300f7c7834d — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/idea/generate_idea.py:50 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c27409107c87cee2 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/idea/verify_idea.py:22 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6fcfc2438db4b7e6 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/rsa-oaep-sha2/generate_rsa_oaep_sha2.py:98 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #27d74df3c2a5b26a — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/seed/generate_seed.py:18 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d9f073d9780b8cd7 — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/seed/generate_seed.py:49 
    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7991aa18c1ff160b — Filesystem access.
pkgs/python/[email protected]/docs/development/custom-vectors/seed/verify_seed.py:20 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #384b0dff06c58532 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:64 
        rustflags = os.environ.get("RUSTFLAGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53b422582be62e00 — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:239 
    rustflags = os.environ.get("RUSTFLAGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a33914b9cc50c6c — Environment-variable access.
pkgs/python/[email protected]/noxfile.py:291 
    if "CARGO_INCREMENTAL" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cef3b8f6e0882bf1 — Filesystem access.
pkgs/python/[email protected]/noxfile.py:406 
        with open(f"{uuid.uuid4()}.lcov", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce3b993ead1fa9a9 — Filesystem access.
pkgs/python/[email protected]/release.py:54 
    content = p.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a84a98ddee009c56 — Filesystem access.
pkgs/python/[email protected]/release.py:60 
    p.write_text(new_content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a770e71444f7e073 — Environment-variable access.
pkgs/python/[email protected]/src/_cffi_src/build_openssl.py:49 
    out_dir = os.environ["OUT_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9dfcf29d776f34fe — Filesystem access.
pkgs/python/[email protected]/src/_cffi_src/utils.py:16 
with open(os.path.join(base_src, "cryptography", "__about__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

datasets

python dependency
expand_more 77 low-confidence finding(s)
low env_fs dependency Excluded from app score #64c0272d07da8922 — Filesystem access.
pkgs/python/[email protected]/setup.py:249 
    long_description=open("README.md", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34497ed28b89f8fe — Filesystem access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:2065 
        with open(dataset_state_json_path, encoding="utf-8") as state_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6076a927a9b4d25d — Filesystem access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:2067 
        with open(dataset_info_path, encoding="utf-8") as dataset_info_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ee1d4f52b471456 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3537 
            prev_env = deepcopy(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3f52a613249b36b — Environment-variable access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3550 
            os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a79f6f23048c7f32 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3552 
            prev_env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #127ed62449f3dd84 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3621 
                        os.environ = prev_env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03a30c2899ed5148 — Filesystem access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:6886 
        legacy_dataset_info: dict = json.loads(fs.read_text(config.DATASETDICT_INFOS_FILENAME, encoding="utf-8")).get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efecdd85ecfd3fd0 — Filesystem access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:6895 
        dataset_card = DatasetCard(fs.read_text(config.REPOCARD_FILENAME, newline="", encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a885e7c7872fc62 — Filesystem access.
pkgs/python/[email protected]/src/datasets/arrow_dataset.py:6993 
        legacy_dataset_infos: dict = json.loads(fs.read_text(config.DATASETDICT_INFOS_FILENAME, encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a7806f8369ea62b — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:21 
HF_ENDPOINT = os.environ.get("HF_ENDPOINT", "https://huggingface.co")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ef90ee80dee36bb — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:42 
USE_TF = os.environ.get("USE_TF", "AUTO").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4fb5cef9836cf68 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:43 
USE_TORCH = os.environ.get("USE_TORCH", "AUTO").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc7ad0b2dd615e60 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:44 
USE_JAX = os.environ.get("USE_JAX", "AUTO").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5266915b91ddf75 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:154 
XDG_CACHE_HOME = os.getenv("XDG_CACHE_HOME", DEFAULT_XDG_CACHE_HOME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #770110fcfebbd9dc — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:156 
HF_CACHE_HOME = os.path.expanduser(os.getenv("HF_HOME", DEFAULT_HF_CACHE_HOME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edc93e52dfe1e924 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:159 
HF_DATASETS_CACHE = Path(os.getenv("HF_DATASETS_CACHE", DEFAULT_HF_DATASETS_CACHE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ce541f866dc882e — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:162 
HF_MODULES_CACHE = Path(os.getenv("HF_MODULES_CACHE", DEFAULT_HF_MODULES_CACHE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee44cba4dbfda264 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:166 
DOWNLOADED_DATASETS_PATH = Path(os.getenv("HF_DATASETS_DOWNLOADED_DATASETS_PATH", DEFAULT_DOWNLOADED_DATASETS_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #569b60485d9ed8a7 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:170 
EXTRACTED_DATASETS_PATH = Path(os.getenv("HF_DATASETS_EXTRACTED_DATASETS_PATH", DEFAULT_EXTRACTED_DATASETS_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ef9f536d982eb37 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:177 
    os.environ.get("HF_UPDATE_DOWNLOAD_COUNTS", "AUTO").upper() in ENV_VARS_TRUE_AND_AUTO_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08dc84bfae90309b — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:214 
_offline = os.environ.get("HF_DATASETS_OFFLINE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71273dc05102822c — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:223 
__HF_DATASETS_DISABLE_PROGRESS_BARS = os.environ.get("HF_DATASETS_DISABLE_PROGRESS_BARS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c043093d7aaa57df — Environment-variable access.
pkgs/python/[email protected]/src/datasets/config.py:232 
IN_MEMORY_MAX_SIZE = float(os.environ.get("HF_DATASETS_IN_MEMORY_MAX_SIZE", DEFAULT_IN_MEMORY_MAX_SIZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b10b2d8239d4f820 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/download/download_manager.py:212 
                if os.environ.get("HF_DATASETS_STACK_MULTIPROCESSING_DOWNLOAD_PROGRESS_BARS") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c64fa6566a3ab8fb — Filesystem access.
pkgs/python/[email protected]/src/datasets/features/features.py:1179 
        with open(names_filepath, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d951cefcb4df2ca — Environment-variable access.
pkgs/python/[email protected]/src/datasets/fingerprint.py:53 
        tmpdir = os.environ.get("TMPDIR") or os.environ.get("TEMP") or os.environ.get("TMP")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bb8284203e9a936 — Filesystem access.
pkgs/python/[email protected]/src/datasets/info.py:344 
            with open(dataset_infos_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd43e6cf4cbb38e0 — Filesystem access.
pkgs/python/[email protected]/src/datasets/info.py:373 
            with open(os.path.join(dataset_infos_dir, config.DATASETDICT_INFOS_FILENAME), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ee61d73ee110cb7 — Filesystem access.
pkgs/python/[email protected]/src/datasets/load.py:434 
            with open(standalone_yaml_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a076134c17dcab6 — Filesystem access.
pkgs/python/[email protected]/src/datasets/load.py:488 
            with open(os.path.join(self.path, config.DATASETDICT_INFOS_FILENAME), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aba0ae486102a26f — Filesystem access.
pkgs/python/[email protected]/src/datasets/load.py:612 
            with open(standalone_yaml_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #429c160b1d517af9 — Filesystem access.
pkgs/python/[email protected]/src/datasets/load.py:697 
            with open(dataset_infos_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af74883cc0e76f6f — Filesystem access.
pkgs/python/[email protected]/src/datasets/load.py:873 
            dataset_card_data = DatasetCard(hffs.read_text(readme_path, newline="", encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de07a08e011b2990 — Filesystem access.
pkgs/python/[email protected]/src/datasets/load.py:877 
            standalone_yaml_data = yaml.safe_load(hffs.read_text(standalone_yaml_path, newline="", encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #820bd2a1caac09a2 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/arrow/arrow.py:40 
                    with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #593fcf3ade176e08 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/arrow/arrow.py:62 
            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e6e25db17d3c5f9 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/cache/cache.py:52 
            or json.loads(Path(cached_directory_path, "dataset_info.json").read_text(encoding="utf-8"))["config_name"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82b91d7dde179220 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/cache/cache.py:80 
            or json.loads(Path(_cached_directory_path, "dataset_info.json").read_text(encoding="utf-8"))["config_name"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0355e0beb720c727 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/cache/cache.py:185 
            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14ad554e872229b8 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/conll/conll.py:126 
                with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef44a1ea670f2b09 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/eval/eval.py:62 
            with open(sample_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6512b20888fe89b — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/folder_based_builder/folder_based_builder.py:313 
            with open(metadata_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ab1e75d1ff59294 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/folder_based_builder/folder_based_builder.py:352 
            with open(metadata_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2957b8a9b015c52e — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/hdf5/hdf5.py:59 
                    with open(first_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b04364cf70665b5 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/hdf5/hdf5.py:75 
                with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f190e036744ac938 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:159 
                    with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67e7961852614778 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:172 
                    trace_events = trace_file.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afbe7ee62ffbca38 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:199 
                    with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24e49d9d54532d18 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:288 
                                    with open(
                                        file, encoding=self.config.encoding, errors=self.config.encoding_errors
                                    ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c16ec2eba1174be — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/lance/lance.py:86 
            data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2197d6f26aed637d — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/pandas/pandas.py:55 
            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49386789fc77b1ba — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/parquet/parquet.py:126 
                        with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea3b677a1b1cbe76 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/parquet/parquet.py:173 
                with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3b567db189f9613 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/parquet/parquet.py:199 
                with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #362c84d30a41c62d — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/spark/spark.py:148 
            open(probe_file, "a")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a318feedf48bf939 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/text/text.py:94 
                with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4f4a7d14f271e6c — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/tsfile/tsfile.py:736 
            with open(file, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a5277b3238109f0 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/webdataset/_tenbin.py:276 
    with open(fname, "wb") as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad02867118acb53f — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/webdataset/_tenbin.py:284 
    with open(fname, "rb") as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36567e434fc59ab7 — Filesystem access.
pkgs/python/[email protected]/src/datasets/packaged_modules/xml/xml.py:67 
            with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0652d5cfe924828d — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/extract.py:72 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30749d1a936dfbd4 — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/extract.py:141 
            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20a893642a8f859c — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/extract.py:172 
            with open(path, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #801af90b6f1941df — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/extract.py:235 
            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2493246431510a07 — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/extract.py:301 
        with open(input_path, "rb") as ifh, open(output_path, "wb") as ofh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fd3162b6b69632e — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/extract.py:311 
            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c55f06bc0f81767d — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/extract.py:377 
            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #546d08a10233ca97 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/utils/file_utils.py:302 
    return patch.dict(os.environ, {"HF_DATASETS_STACK_MULTIPROCESSING_DOWNLOAD_PROGRESS_BARS": "1"})

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2cc4ce6c36b31df — Environment-variable access.
pkgs/python/[email protected]/src/datasets/utils/file_utils.py:324 
            if os.environ.get("HF_DATASETS_STACK_MULTIPROCESSING_DOWNLOAD_PROGRESS_BARS") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4799e6eb8b4a7461 — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/file_utils.py:403 
        with open(incomplete_path, "w+b") as temp_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4ee72fb9515f970 — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/file_utils.py:414 
        with open(meta_path, "w", encoding="utf-8") as meta_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bc85f8b14342ead — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/file_utils.py:967 
        return open(main_hop, mode, *args, **kwargs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47df6cd79b6acfc1 — Filesystem access.
pkgs/python/[email protected]/src/datasets/utils/info_utils.py:84 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e11c5cc00f5201a7 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/utils/logging.py:54 
    env_level_str = os.getenv("DATASETS_VERBOSITY", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30696ad364207287 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/utils/tf_utils.py:413 
        os.environ["TF_CPP_MIN_LOG_LEVEL"] = "3"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #717a7646bd91fb03 — Environment-variable access.
pkgs/python/[email protected]/src/datasets/utils/tqdm.py:115 
        elif kwargs.get("disable") is None and os.getenv("TQDM_POSITION") == "-1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

defusedxml

python dependency
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #6c8f1446592794af — Filesystem access.
pkgs/python/[email protected]/defusedxml/expatbuilder.py:84 
        fp = open(file, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #954d6d326f5b3820 — Filesystem access.
pkgs/python/[email protected]/other/python_genshi.py:6 
with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7eef0326ffa0352a — Filesystem access.
pkgs/python/[email protected]/setup.py:27 
with open("README.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6775f3745f2d8d14 — Filesystem access.
pkgs/python/[email protected]/setup.py:29 
with open("CHANGES.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f3e8ee318443a2a — Environment-variable access.
pkgs/python/[email protected]/tests.py:59 
os.environ["http_proxy"] = "http://127.0.9.1:9"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f854f83ae006ccd — Environment-variable access.
pkgs/python/[email protected]/tests.py:60 
os.environ["https_proxy"] = os.environ["http_proxy"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88c0ea98afec50d3 — Environment-variable access.
pkgs/python/[email protected]/tests.py:61 
os.environ["ftp_proxy"] = os.environ["http_proxy"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b57e0bf3c7baa8a4 — Filesystem access.
pkgs/python/[email protected]/tests.py:83 
        with io.open(xmlfile, mode) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

distro

python dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #d274e5360c15c248 — Environment-variable access.
pkgs/python/[email protected]/src/distro/distro.py:75 
_UNIXCONFDIR = os.environ.get("UNIXCONFDIR", "/etc")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #492f5167ad5bf515 — Environment-variable access.
pkgs/python/[email protected]/src/distro/distro.py:76 
_UNIXUSRLIBDIR = os.environ.get("UNIXUSRLIBDIR", "/usr/lib")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #529f487dd044a8cd — Filesystem access.
pkgs/python/[email protected]/src/distro/distro.py:1099 
            with open(self.os_release_file, encoding="utf-8") as release_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3818bcadcfeb68c4 — Filesystem access.
pkgs/python/[email protected]/src/distro/distro.py:1221 
            with open(
                os.path.join(self.etc_dir, "debian_version"), encoding="ascii"
            ) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a64c23412e70e9a — Filesystem access.
pkgs/python/[email protected]/src/distro/distro.py:1323 
            with open(filepath, encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fastapi

python dependency
expand_more 64 low-confidence finding(s)
low env_fs dependency Excluded from app score #b394e781cc1ef560 — Filesystem access.
pkgs/python/[email protected]/docs_src/background_tasks/tutorial001_py310.py:7 
    with open("log.txt", mode="w") as email_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ff63eedb260044d — Filesystem access.
pkgs/python/[email protected]/docs_src/background_tasks/tutorial002_an_py310.py:9 
    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33cd7c7b95c7e4b3 — Filesystem access.
pkgs/python/[email protected]/docs_src/background_tasks/tutorial002_py310.py:7 
    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #728c03cfe617080c — Filesystem access.
pkgs/python/[email protected]/docs_src/custom_response/tutorial008_py310.py:11 
        with open(some_file_path, mode="rb") as file_like:  # (2)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #291b4b33fd03dafd — Filesystem access.
pkgs/python/[email protected]/docs_src/events/tutorial002_py310.py:8 
    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d93b458e06b3dfc0 — Filesystem access.
pkgs/python/[email protected]/docs_src/generate_clients/tutorial004_py310.py:5 
openapi_content = json.loads(file_path.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99044cc337bdf67f — Filesystem access.
pkgs/python/[email protected]/docs_src/generate_clients/tutorial004_py310.py:15 
file_path.write_text(json.dumps(openapi_content))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #97c40d745954a101 — Filesystem access.
pkgs/python/[email protected]/scripts/add_latest_release_date.py:12 
    with open(RELEASE_NOTES_FILE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #621b91cbcfc6528a — Filesystem access.
pkgs/python/[email protected]/scripts/add_latest_release_date.py:31 
        with open(RELEASE_NOTES_FILE, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #507f096f88f9aeb9 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/contributors.py:129 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #1031f1e77e95bf00 — Filesystem access.
pkgs/python/[email protected]/scripts/contributors.py:227 
    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2452f6c4034d12e8 — Filesystem access.
pkgs/python/[email protected]/scripts/contributors.py:233 
    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2469b5e51585cae4 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:105 
    return yaml.unsafe_load(en_config_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d54cc4a0a809e577 — Environment-variable access.
pkgs/python/[email protected]/scripts/docs.py:129 
    os.environ["DYLD_FALLBACK_LIBRARY_PATH"] = "/opt/homebrew/lib"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bdb9c4155cea0a28 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:143 
    new_llm_prompt_path.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e6bbabc6523b6420 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:223 
    missing_translation = (docs_path / "missing-translation.md").read_text(
        encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #919292f22c6a904e — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:229 
    translation_banner = translation_banner_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9f13ff2581a86464 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:236 
                markdown = translated_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3a4e9484cac825a4 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:238 
                    staged_file.write_text(markdown, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3afb68b1c1fa4e34 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:242 
                staged_file.write_text(
                    add_markdown_notice(markdown, banner), encoding="utf-8"
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d38bc0720823027b — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:246 
                markdown = staged_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #daa99a3e8a34ebb3 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:247 
                staged_file.write_text(
                    add_markdown_notice(markdown, missing_translation),
                    encoding="utf-8",
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #943a022ff8a19d20 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:277 
    config_path.write_text(
        yaml.dump(config, sort_keys=False, width=200, allow_unicode=True),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #048bc44fd4c42a70 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:295 
    config = yaml.unsafe_load(config_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #23535fb9656399fd — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:349 
    content = en_index.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #581f8a0795056f58 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:355 
    sponsors = yaml.safe_load(sponsors_data_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c60a8b614bc2a527 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:384 
    old_content = readme_path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5a3d42cb9726ae8e — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:389 
        readme_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5a6c4002820bbf7a — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:430 
        en_config_path.write_text(
            yaml.dump(updated_config, sort_keys=False, width=200, allow_unicode=True),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4bf55b58b4ca60a7 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:488 
        language_names_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #74f7349989c76b0f — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:542 
    sponsors = yaml.safe_load(sponsors_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d10b8d0b6dc81eb6 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:553 
    old_content = partial_path.read_text("utf-8") if partial_path.is_file() else ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #78772440a34875e1 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:558 
        partial_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0dfe9caab2c5de15 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:609 
    base_content = file_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b085b44fe62ea398 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:657 
        version_file.write_text(content_format, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0d5f622cc489b43c — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:713 
        content = md_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #eb6661296c8d95e5 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:720 
            md_file.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9e84489794d923f3 — Filesystem access.
pkgs/python/[email protected]/scripts/docs.py:735 
        all_docs_content += md_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #506a495bf1890ecd — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/notify_translations.py:218 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #726653877bc2fbec — Filesystem access.
pkgs/python/[email protected]/scripts/notify_translations.py:319 
    contents = settings.github_event_path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #34e099aa7c08ef64 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/people.py:202 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #319fad6b36cf1802 — Filesystem access.
pkgs/python/[email protected]/scripts/people.py:384 
    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #328bac42ad39f208 — Filesystem access.
pkgs/python/[email protected]/scripts/people.py:390 
    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #20a8d9ebc29c0704 — Filesystem access.
pkgs/python/[email protected]/scripts/prepare_release.py:146 
    version_file_content = version_file.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c6fa1e2ffc75b801 — Filesystem access.
pkgs/python/[email protected]/scripts/prepare_release.py:147 
    release_notes_content = release_notes_file.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7ddb238b915bf26a — Filesystem access.
pkgs/python/[email protected]/scripts/prepare_release.py:152 
    version_file.write_text(
        update_version_file(version_file_content, version, version_file)
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #907e200031020e5f — Filesystem access.
pkgs/python/[email protected]/scripts/prepare_release.py:155 
    release_notes_file.write_text(
        update_release_notes(
            release_notes_content, version, parsed_release_date, release_notes_file
        )
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e56d6e1210c27073 — Filesystem access.
pkgs/python/[email protected]/scripts/prepare_release.py:178 
    typer.echo(get_current_version(version_file.read_text(), version_file))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4ef7020b1aeee1fc — Filesystem access.
pkgs/python/[email protected]/scripts/prepare_release.py:206 
    version = get_current_version(version_file.read_text(), version_file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9a16ee925cffc4d9 — Filesystem access.
pkgs/python/[email protected]/scripts/prepare_release.py:209 
            release_notes_file.read_text(), version, release_notes_file

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #49810bdbc179dba6 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/sponsors.py:100 
    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #a0e1836ada3b847b — Filesystem access.
pkgs/python/[email protected]/scripts/sponsors.py:148 
    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #47b5b2008cb43bab — Filesystem access.
pkgs/python/[email protected]/scripts/sponsors.py:154 
    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b48fc58261308119 — Filesystem access.
pkgs/python/[email protected]/scripts/topic_repos.py:52 
    repos_old_content = repos_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0be554daaed0ace5 — Filesystem access.
pkgs/python/[email protected]/scripts/topic_repos.py:57 
    repos_path.write_text(new_repos_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cc57918b454f7155 — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:31 
general_prompt = general_prompt_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2ac9c747fcc771cf — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:38 
    return yaml.safe_load(Path("docs/language_names.yml").read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2d19182e678ce3ba — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:121 
    lang_prompt_content = lang_prompt_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #897c6f8d8daa1e44 — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:129 
    original_content = en_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ad100e067989b39d — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:133 
        old_translation = out_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #069a3f5a6a32a19b — Filesystem access.
pkgs/python/[email protected]/scripts/translate.py:178 
    out_path.write_text(out_content, encoding="utf-8", newline="\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #739b6f24b667fd6e — Filesystem access.
pkgs/python/[email protected]/scripts/translation_fixer.py:81 
        doc_lines = path.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #df7955167e8f2cb8 — Filesystem access.
pkgs/python/[email protected]/scripts/translation_fixer.py:82 
        en_doc_lines = en_doc_path.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #298e71a8722e92e8 — Filesystem access.
pkgs/python/[email protected]/scripts/translation_fixer.py:94 
        path.write_text("\n".join(doc_lines), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-api-core

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #db83fe136fb18421 — Environment-variable access.
pkgs/python/[email protected]/google/api_core/client_logging.py:59 
    scopes = os.getenv("GOOGLE_SDK_PYTHON_LOGGING_SCOPE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b76169bd6fced0d9 — Environment-variable access.
pkgs/python/[email protected]/google/api_core/operations_v1/abstract_operations_base_client.py:307 
            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0953c672fcc12180 — Environment-variable access.
pkgs/python/[email protected]/google/api_core/operations_v1/abstract_operations_base_client.py:333 
            use_mtls_env = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-genai

python dependency
expand_more 37 low-confidence finding(s)
low env_fs dependency Excluded from app score #90a85860756ceb8c — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:110 
  env_google_api_key = os.environ.get('GOOGLE_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb0fb449c57adb74 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:111 
  env_gemini_api_key = os.environ.get('GEMINI_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab4cb5cdf4b4bd71 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:616 
      env_enterprise_str = os.environ.get('GOOGLE_GENAI_USE_ENTERPRISE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b78bab2600ac9f3 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:617 
      env_vertexai_str = os.environ.get('GOOGLE_GENAI_USE_VERTEXAI', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db3cbbb9907c2a13 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:677 
    env_project = os.environ.get('GOOGLE_CLOUD_PROJECT', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4212eadbc6e35eee — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:678 
    env_location = os.environ.get('GOOGLE_CLOUD_LOCATION', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09fd7e053e5c8874 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:1046 
          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b9d88d44dac0165 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:1047 
          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf972f8627c6bd3b — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:1100 
          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #357d38d2fc4deec5 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:1101 
          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #835b5976ef18ef08 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:1158 
          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fafd6f174e7c02fd — Environment-variable access.
pkgs/python/[email protected]/google/genai/_api_client.py:1159 
          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c61c2d15a80653f — Filesystem access.
pkgs/python/[email protected]/google/genai/_api_client.py:1764 
      with open(file_path, 'rb') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56870542528f3a75 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_base_url.py:48 
    return _default_base_vertex_url or os.getenv('GOOGLE_VERTEX_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #497d49e4f4da5538 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_base_url.py:50 
    return _default_base_gemini_url or os.getenv('GOOGLE_GEMINI_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a841e002355a54ab — Filesystem access.
pkgs/python/[email protected]/google/genai/_gaos/types/base64fileinput.py:39 
            with open(value, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4934f3c443395f74 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/logger.py:40 
    if os.getenv("GOOGLE_GENAI_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2af436d5afeeda8 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:95 
    if os.getenv("GOOGLE_GENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #118b04fb59a9f41b — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:96 
        security_dict["api_key"] = os.getenv("GOOGLE_GENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3a6d5a7d51b5bea — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:98 
    if os.getenv("GOOGLE_GENAI_ACCESS_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f04591768075b961 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:99 
        security_dict["access_token"] = os.getenv("GOOGLE_GENAI_ACCESS_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9eb39301368ab46b — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:101 
    if os.getenv("GOOGLE_GENAI_DEFAULT_HEADERS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e9951a6f63442b4c — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:102 
        security_dict["default_headers"] = os.getenv("GOOGLE_GENAI_DEFAULT_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10173e6bee1d4e59 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_gaos/utils/values.py:79 
    env_value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa508207ce23e81b — Filesystem access.
pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:111 
  with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34a991aa9ec7dc84 — Filesystem access.
pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:128 
    with open(tmp_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dccb238d9b2af85 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:223 
      os.environ.get('PYTEST_CURRENT_TEST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d4e297c530c79e8 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:315 
      self.replays_directory = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28aafd5acc6fafd4 — Environment-variable access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:315 
      self.replays_directory = os.environ.get(
          'GOOGLE_GENAI_REPLAYS_DIRECTORY', None
      )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46593ff40de59e14 — Filesystem access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:359 
      with open(replay_file_path, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4028240dd9feebbd — Filesystem access.
pkgs/python/[email protected]/google/genai/_replay_api_client.py:386 
    with open(replay_file_path, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e43297b4678983c5 — Environment-variable access.
pkgs/python/[email protected]/google/genai/client.py:197 
      default_factory=lambda: os.getenv('GOOGLE_GENAI_CLIENT_MODE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70cbf6e2eb95e039 — Environment-variable access.
pkgs/python/[email protected]/google/genai/client.py:201 
      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAYS_DIRECTORY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0edbf7b01ec8694 — Environment-variable access.
pkgs/python/[email protected]/google/genai/client.py:205 
      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAY_ID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #219ac72a751529fb — Filesystem access.
pkgs/python/[email protected]/google/genai/types.py:9036 
    image_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a6a3248a0cf7854 — Filesystem access.
pkgs/python/[email protected]/google/genai/types.py:11421 
    video_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4b561c13a124855 — Filesystem access.
pkgs/python/[email protected]/google/genai/types.py:22491 
    with open(file_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gunicorn

python dependency
expand_more 84 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #e3254c281a279028 — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:29 
bind = os.environ.get("GUNICORN_BIND", "0.0.0.0:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3a3fab5928e7dfa0 — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:33 
workers = int(os.environ.get("GUNICORN_WORKERS", min(4, multiprocessing.cpu_count() + 1)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8e2c3703b7bd49ff — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:64 
dirty_workers = int(os.environ.get("DIRTY_WORKERS", 9))  # 2+2+4+1 = 9

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #828d94dfcb4ea6fd — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:67 
dirty_timeout = int(os.environ.get("DIRTY_TIMEOUT", 300))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8c0717dd4c5f227c — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:70 
dirty_threads = int(os.environ.get("DIRTY_THREADS", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #45ab1c7f7dd0dfc1 — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:73 
dirty_graceful_timeout = int(os.environ.get("DIRTY_GRACEFUL_TIMEOUT", 30))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cdaaa0a2bd8252e7 — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:94 
loglevel = os.environ.get("LOG_LEVEL", "info")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8cd0787c6280af79 — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:151 
reload = os.environ.get("GUNICORN_RELOAD", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0cd5d4bcb6d9a609 — Environment-variable access.
pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:154 
preload_app = os.environ.get("GUNICORN_PRELOAD", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c666aa38675198d8 — Environment-variable access.
pkgs/python/[email protected]/examples/dirty_example/gunicorn_conf.py:16 
bind = os.environ.get("GUNICORN_BIND", "127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f9d68fff3e494508 — Environment-variable access.
pkgs/python/[email protected]/examples/dirty_example/test_integration.py:47 
    base = os.environ.get("TEST_BASE_URL", "http://localhost:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #53400d2a73f4f7c3 — Environment-variable access.
pkgs/python/[email protected]/examples/dirty_example/test_stash_integration.py:23 
BASE_URL = os.environ.get("TEST_BASE_URL", "http://localhost:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #7cd240df18ba8dd2 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/dirty_example/test_stash_integration.py:30 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/dirty_example/test_stash_integration.py:23 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/dirty_example/test_stash_integration.py:30 
        with urllib.request.urlopen(url, timeout=10) as resp:

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #e41e9e223d319a9f — Environment-variable access.
pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:11 
    base_url = os.environ.get("EMBEDDING_SERVICE_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #1d0a821cfbc58d2e — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:15 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:11 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:15 
    response = requests.post(url, json={"texts": ["Hello world"]})

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low pii_flow tooling Excluded from app score unreachable #2827cd02c863bd2c — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:23 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:11 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:23 
    response = requests.post(url, json={"texts": texts})

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low pii_flow tooling Excluded from app score unreachable #0967d6710614ee44 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:29 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:11 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:29 
    response = requests.post(url, json={"texts": ["test", "test"]})

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #9ab39d7e9e4e1e3f — Environment-variable access.
pkgs/python/[email protected]/examples/frameworks/django/testing/manage.py:9 
    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "testing.settings")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #a9bd55bc6e0994be — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/frameworks/django/testing/testing/apps/someapp/middleware.py:12 
        requests.get('http://requestb.in/15s95oz1')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #44e33b585f6585c0 — Environment-variable access.
pkgs/python/[email protected]/examples/frameworks/django/testing/testing/wsgi.py:28 
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "testing.settings")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #42469642874b46b3 — Environment-variable access.
pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:19 
bind = os.environ.get('GUNICORN_BIND', '0.0.0.0:8443')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2877c090c24b834c — Environment-variable access.
pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:23 
workers = int(os.environ.get('GUNICORN_WORKERS', multiprocessing.cpu_count() * 2 + 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8833c56da18bbd4b — Environment-variable access.
pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:33 
certfile = os.environ.get('GUNICORN_CERTFILE', _default_cert)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0a63a847e0f754ea — Environment-variable access.
pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:34 
keyfile = os.environ.get('GUNICORN_KEYFILE', _default_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6ec50b2de3362eb0 — Environment-variable access.
pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:48 
loglevel = os.environ.get('GUNICORN_LOG_LEVEL', 'info')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d38e756ded68fc2a — Filesystem access.
pkgs/python/[email protected]/examples/read_django_settings.py:13 
with open('frameworks/django/testing/testing/settings.py') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8e76e5ebb6302557 — Filesystem access.
pkgs/python/[email protected]/examples/sendfile.py:16 
    f = open(fname, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ba469589d6a0a928 — Environment-variable access.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:14 
    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #44c14ada786216a1 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:15 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:14 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:15 
    response = requests.get(f"{base_url}/health")

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #262039a3b517df4d — Environment-variable access.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:23 
    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #d94a4183c80974d1 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:25 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:23 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:25 
    response = requests.post(
        f"{base_url}/chat",
        json={"prompt": "hello"},
        stream=True,
        headers={"Accept": "text/event-stream"}
    )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #fcf6a4f47548ab76 — Environment-variable access.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:56 
    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #cb105428cf713439 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:58 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:56 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:58 
    response = requests.post(
        f"{base_url}/chat/sync",
        json={"prompt": "hello"}
    )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #36b3f9494ae4ada1 — Environment-variable access.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:72 
    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #517e71ad2f258574 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:74 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:72 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:74 
    response = requests.post(
        f"{base_url}/chat",
        json={"prompt": "hello", "thinking": True},
        stream=True
    )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #47858d74cfa28833 — Environment-variable access.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:100 
    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #2b60ec5ceeb97c1c — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:106 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:100 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:106 
        response = requests.post(
            f"{base_url}/chat/sync",
            json={"prompt": prompt}
        )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #def7aabf8f18fa8a — Environment-variable access.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:122 
    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #1306381f8a4300cf — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:124 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:122 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:124 
    response = requests.post(
        f"{base_url}/chat",
        json={"prompt": "hello"},
        stream=True
    )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #42695b55185413d9 — Filesystem access.
pkgs/python/[email protected]/examples/websocket/gevent_websocket.py:445 
        data = open(os.path.join(
                     os.path.dirname(__file__),
                     'websocket.html')).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33a8947b027e65e7 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/app/base.py:220 
            if os.environ.get('NOTIFY_SOCKET'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59c52f063bf0a649 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:54 
        os.environ["SERVER_SOFTWARE"] = SERVER_SOFTWARE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1979614385f0a86a — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:117 
        if 'GUNICORN_PID' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29ddd338df70aab0 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:136 
                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6a149302bac1f24 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:150 
        if 'GUNICORN_PID' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb6aab0b166a0d35 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:151 
            self.master_pid = int(os.environ.get('GUNICORN_PID'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #557b4466b8218c8c — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:176 
                for fd in os.environ.pop('GUNICORN_FD').split(','):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b99db30738ecd45 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:362 
            del os.environ['GUNICORN_PID']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d627c5751ed9dcb8 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:514 
                os.environ[k] = self.cfg.env_orig[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcde1737b8c9d785 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:518 
                    del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a46cd0d1ccb24d9d — Filesystem access.
pkgs/python/[email protected]/gunicorn/arbiter.py:812 
            with open(pidfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb851fbb30922dc4 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/arbiter.py:869 
            os.environ['GUNICORN_DIRTY_SOCKET'] = socket_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37545edbd55bf92c — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:54 
        self.env_orig = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62a71b1f2c46b78a — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:231 
        if 'SENDFILE' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a5c55870393d020 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:232 
            sendfile = os.environ['SENDFILE'].lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9778d5721f840c06 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:636 
    if 'PORT' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c884cd43fde3d2cd — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:637 
        default = ['0.0.0.0:{0}'.format(os.environ.get('PORT'))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ac089761e8fc4c8 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:690 
    default = int(os.environ.get("WEB_CONCURRENCY", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae17695333d2c4a4 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:1320 
    default = os.environ.get("FORWARDED_ALLOW_IPS", "127.0.0.1,::1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d367cffc7036e73 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/config.py:3138 
    xdg_runtime = os.environ.get('XDG_RUNTIME_DIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb6e6478727b120d — Environment-variable access.
pkgs/python/[email protected]/gunicorn/ctl/handlers.py:368 
            dirty_socket_path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62d7749743604743 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/ctl/handlers.py:530 
            dirty_socket_path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ee066b6e03202ac — Filesystem access.
pkgs/python/[email protected]/gunicorn/dirty/arbiter.py:242 
                with open(self.pidfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47b1f73e4890fcca — Environment-variable access.
pkgs/python/[email protected]/gunicorn/dirty/arbiter.py:248 
        os.environ['GUNICORN_DIRTY_SOCKET'] = self.socket_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #329df373fa28d9d4 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/dirty/client.py:671 
        path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2555915cc1c3ce30 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/dirty/stash.py:429 
        path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9604017214460ec — Environment-variable access.
pkgs/python/[email protected]/gunicorn/dirty/worker.py:152 
                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e519c690e57da371 — Filesystem access.
pkgs/python/[email protected]/gunicorn/glogging.py:205 
            self.logfile = open(cfg.errorlog, 'a+')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fd746f407f98497 — Filesystem access.
pkgs/python/[email protected]/gunicorn/glogging.py:245 
                    config_json = json.load(open(cfg.logconfig_json))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3405aa2da8909ac — Filesystem access.
pkgs/python/[email protected]/gunicorn/glogging.py:388 
                self.logfile = open(self.cfg.errorlog, 'a+')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e7a1661448439d9 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/http/wsgi.py:196 
    script_name = os.environ.get("SCRIPT_NAME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc3cc9157d98ac0c — Filesystem access.
pkgs/python/[email protected]/gunicorn/pidfile.py:56 
            with open(self.fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #929d38a3a74c30af — Filesystem access.
pkgs/python/[email protected]/gunicorn/pidfile.py:69 
            with open(self.fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfbf0ee22ea4743e — Environment-variable access.
pkgs/python/[email protected]/gunicorn/systemd.py:35 
    fds = int(os.environ.get('LISTEN_FDS', 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4add107b0bcc94c0 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/systemd.py:36 
    listen_pid = int(os.environ.get('LISTEN_PID', 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c90a1da6f1b55145 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/systemd.py:42 
        os.environ.pop('LISTEN_PID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64dab0453099863b — Environment-variable access.
pkgs/python/[email protected]/gunicorn/systemd.py:43 
        os.environ.pop('LISTEN_FDS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4258f5610118d3c — Environment-variable access.
pkgs/python/[email protected]/gunicorn/systemd.py:60 
    addr = os.environ.get('NOTIFY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c66d1e46762faae9 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/systemd.py:75 
            os.environ.pop('NOTIFY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f9502f0e5b15e31 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/util.py:489 
        a = os.stat(os.environ['PWD'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #974364530ba49687 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/util.py:492 
            cwd = os.environ['PWD']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc3ef1c4ac920a96 — Environment-variable access.
pkgs/python/[email protected]/gunicorn/util.py:517 
    if 'GUNICORN_FD' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cbfe2886a72748e — Filesystem access.
pkgs/python/[email protected]/gunicorn/util.py:607 
        with open(path, 'a') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #531cda7af28fe29f — Environment-variable access.
pkgs/python/[email protected]/gunicorn/workers/base.py:96 
                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #46356ca886238312 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:34 
        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e6cb46fb04007d6 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:35 
            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0c1105c94d2a3ab — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:36 
        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0289efffd13c3ea — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:37 
            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx2

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #84b897e475dbf18b — Environment-variable access.
pkgs/python/[email protected]/httpx2/_config.py:34 
        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: no cover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27f7b8ab64ff6a51 — Environment-variable access.
pkgs/python/[email protected]/httpx2/_config.py:35 
            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3de409a8488cf80f — Environment-variable access.
pkgs/python/[email protected]/httpx2/_config.py:36 
        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: no cover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8271c2190a8996f — Environment-variable access.
pkgs/python/[email protected]/httpx2/_config.py:37 
            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

jiter

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #61fad0e59f6bd28b — Filesystem access.
pkgs/python/[email protected]/crates/jiter-python/bench.py:22 
    CASES[p.stem] = p.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ec24814e44dbe6c — Filesystem access.
pkgs/python/[email protected]/crates/jiter/benches/generate_big.py:21 
(THIS_DIR / 'big.json').write_text(json.dumps(data, separators=(',', ':')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langchain-experimental

python dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #4b5919bb9a5d4674 — Filesystem access.
pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:438 
            with open(save_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1cf596bd44753d27 — Filesystem access.
pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:441 
            with open(save_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81a4cd968f4ec32c — Filesystem access.
pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:462 
            with open(load_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88477f7f0d9c5804 — Filesystem access.
pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:465 
            with open(load_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccb2e63ee503af94 — Filesystem access.
pkgs/python/[email protected]/langchain_experimental/rl_chain/model_repository.py:43 
        with open(self.model_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #661b6886133f1b7e — Filesystem access.
pkgs/python/[email protected]/langchain_experimental/rl_chain/model_repository.py:60 
            with open(self.model_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f531d38a0f81996f — Filesystem access.
pkgs/python/[email protected]/langchain_experimental/rl_chain/vw_logger.py:16 
            with open(self.path, "a") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langchain-text-splitters

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #d912b157e6dfd95e — Filesystem access.
pkgs/python/[email protected]/langchain_text_splitters/html.py:240 
            html_content = pathlib.Path(file).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

llama-index-llms-openai

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #46e7cda0274b591a — Environment-variable access.
pkgs/python/[email protected]/llama_index/llms/openai/utils.py:1039 
    openai_api_key = api_key or os.environ.get("OPENAI_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

nano-vectordb

python dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #c933b7d7ad747a1e — Filesystem access.
pkgs/python/[email protected]/nano_vectordb/dbs.py:38 
    with open(file_name, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a608b7a02f36508c — Filesystem access.
pkgs/python/[email protected]/nano_vectordb/dbs.py:142 
        with open(self.storage_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67c82cc9b0d07786 — Filesystem access.
pkgs/python/[email protected]/setup.py:3 
with open("./readme.md", "r") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3daae976cf442a15 — Filesystem access.
pkgs/python/[email protected]/setup.py:9 
with open("./nano_vectordb/__init__.py") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ff16974a0744950 — Filesystem access.
pkgs/python/[email protected]/setup.py:17 
with open("./requirements.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

neo4j

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #b91bf79a0e64f896 — Environment-variable access.
pkgs/python/[email protected]/src/neo4j/_debug/_config.py:21 
ENABLED = sys.flags.dev_mode or bool(os.getenv("PYTHONNEO4JDEBUG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

networkx

python dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #fe7b76c0961c0902 — Environment-variable access.
pkgs/python/[email protected]/doc/conf.py:96 
os.environ["_NETWORKX_BUILDING_DOCS_"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ba6897b363da1c44 — Filesystem access.
pkgs/python/[email protected]/examples/external/javascript_force.py:27 
json.dump(d, open("force/force.json", "w"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #1536d79dff9306f3 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/graph/plot_football.py:24 
sock = urllib.request.urlopen(url)  # open URL

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #d6411ac1e6e7e9d6 — Filesystem access.
pkgs/python/[email protected]/examples/graphviz_layout/plot_lanl_routes.py:22 
        fh = open("lanl_routes.edgelist")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #dcc290bf672cd6b4 — Filesystem access.
pkgs/python/[email protected]/examples/subclass/plot_printgraph.py:28 
            self.fh = open(file, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3cdc3a14d54477f — Environment-variable access.
pkgs/python/[email protected]/networkx/conftest.py:47 
        backend = os.environ.get("NETWORKX_TEST_BACKEND")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f3b94e249d3a9219 — Environment-variable access.
pkgs/python/[email protected]/networkx/conftest.py:71 
            fallback_to_nx = os.environ.get("NETWORKX_FALLBACK_TO_NX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1006685acb97862d — Environment-variable access.
pkgs/python/[email protected]/networkx/lazy_imports.py:75 
    if os.environ.get("EAGER_IMPORT", ""):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #728308a8843d74f8 — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:153 
            os.environ.get("NETWORKX_CACHE_CONVERTED_GRAPHS", True)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #593fdd7333a77912 — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:155 
        fallback_to_nx=bool(os.environ.get("NETWORKX_FALLBACK_TO_NX", False)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ad0e877c6c61ac9 — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:157 
            _comma_sep_to_list(os.environ.get("NETWORKX_WARNINGS_TO_IGNORE", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64652d7f5424a866 — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:167 
        for key, val in os.environ.items()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be1aa9d3c59e1b63 — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:175 
            os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b46aa30aabe33496 — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:175 
            os.environ.get(
                "NETWORKX_BACKEND_PRIORITY",
                os.environ.get("NETWORKX_AUTOMATIC_BACKENDS", ""),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59502638da102504 — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:177 
                os.environ.get("NETWORKX_AUTOMATIC_BACKENDS", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4436fa4b19b6d9b — Environment-variable access.
pkgs/python/[email protected]/networkx/utils/backends.py:2152 
if os.environ.get("_NETWORKX_BUILDING_DOCS_"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

numpy

python dependency
expand_more 977 low-confidence finding(s)
low env_fs dependency Excluded from app score #8fe07ee4817a0ec6 — Filesystem access.
pkgs/python/[email protected]/.spin/cmds.py:124 
    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08df87ca041f7500 — Environment-variable access.
pkgs/python/[email protected]/.spin/cmds.py:326 
    PATH = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cb92416cc21b82b — Environment-variable access.
pkgs/python/[email protected]/.spin/cmds.py:331 
    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1dfb3c34ab6c9919 — Environment-variable access.
pkgs/python/[email protected]/.spin/cmds.py:505 
    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f66e6a44c887f72 — Environment-variable access.
pkgs/python/[email protected]/.spin/cmds.py:523 
    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d46e441aa7c60ba — Environment-variable access.
pkgs/python/[email protected]/.spin/cmds.py:547 
    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94eee2698cf7ee64 — Filesystem access.
pkgs/python/[email protected]/.spin/cmds.py:629 
        with open(local, "wt", encoding="utf8") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad667791d1582d1c — Filesystem access.
pkgs/python/[email protected]/.spin/cmds.py:632 
        with open(pkg_config_fname, "wt", encoding="utf8") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bc6fb0fa26d1f9d5 — Environment-variable access.
pkgs/python/[email protected]/benchmarks/benchmarks/__init__.py:12 
    if 'SHELL' in os.environ and sys.platform != 'win32':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #931c61abcc949b33 — Filesystem access.
pkgs/python/[email protected]/benchmarks/benchmarks/__init__.py:35 
        with open(lock_path, 'a+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #60dcb9a3c8393e7d — Filesystem access.
pkgs/python/[email protected]/doc/neps/tools/build_index.py:34 
        with open(source) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d8232f4a56141743 — Filesystem access.
pkgs/python/[email protected]/doc/neps/tools/build_index.py:125 
    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87dff039304943a9 — Filesystem access.
pkgs/python/[email protected]/doc/postprocess.py:18 
        with open(fn, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba400c3e54de7082 — Filesystem access.
pkgs/python/[email protected]/doc/postprocess.py:24 
        with open(fn, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d4171fcfad8417e — Filesystem access.
pkgs/python/[email protected]/doc/preprocess.py:18 
    with open(gen_path, 'w') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16cd396e269592b7 — Filesystem access.
pkgs/python/[email protected]/doc/preprocess.py:35 
    with open(os.path.join(dsrc_path, "doxyfile")) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bdf24d8bb5e1ab6a — Filesystem access.
pkgs/python/[email protected]/doc/preprocess.py:44 
            with open(conf_path) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #828cef8b031a7b44 — Environment-variable access.
pkgs/python/[email protected]/doc/source/conf.py:247 
if os.environ.get('CIRCLE_JOB') and os.environ['CIRCLE_BRANCH'] != 'main':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f159a08996280142 — Environment-variable access.
pkgs/python/[email protected]/doc/source/conf.py:249 
    switcher_version = os.environ['CIRCLE_BRANCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #905ce8d9f90b0805 — Environment-variable access.
pkgs/python/[email protected]/numpy/__init__.py:881 
        use_hugepage = os.environ.get("NUMPY_MADVISE_HUGEPAGE", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #700a0c6e8d58d8b6 — Environment-variable access.
pkgs/python/[email protected]/numpy/__init__.py:913 
    if (os.environ.get("NPY_PROMOTION_STATE", "weak") != "weak"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #639c599590fbef9e — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:270 
    with open(source) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22eb8e32174b2779 — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:320 
        fid = open(file, 'r')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63dbdb24a1cd5103 — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:323 
        outfile = open(newname, 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #770e8a40c3e9a3ad — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:8 
    with open(init) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32033adddcec5f87 — Environment-variable access.
pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:89 
                os.environ.get('MESON_DIST_ROOT', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd70b59936865731 — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:98 
        with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81071eead39c5e34 — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/process_src_template.py:32 
    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c7a2499b54ee571 — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/tempita.py:34 
    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f30481d24e77620a — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:164 
        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c87d7903b7f57f5 — Environment-variable access.
pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1090 
        vars.update(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6220fef21eb5c289 — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1104 
        with open(template_name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55f2b985930eea90 — Filesystem access.
pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1109 
        with open(options.output, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4af4ffa999919d45 — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/__init__.py:17 
    if envkey not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b5f785a031bbeee — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/_add_newdocs_scalars.py:60 
            machine = os.environ.get('PROCESSOR_ARCHITEW6432', '') \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5aa0525b0639be41 — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/_add_newdocs_scalars.py:61 
                    or os.environ.get('PROCESSOR_ARCHITECTURE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1252c727dcc74d4 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/_methods.py:242 
        ctx = open(os.fspath(file), "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b76e58ceed666e23 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:249 
        fo = open(filename, 'r')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43e10ef8d9733513 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:321 
        with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3911128b4fd44c7b — Filesystem access.
pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:325 
    with open(filename, 'w') as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06867b980ea3be79 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:537 
    with open(file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ba1325f78aad0d3 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/code_generators/generate_umath.py:1689 
    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #013d2ab357071e19 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/code_generators/generate_umath_doc.py:20 
    with open(target, 'w') as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af9fe35fb58160f5 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/memmap.py:235 
            f_ctx = open(
                os.fspath(filename),
                ('r' if mode == 'c' else mode) + 'b'
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #673c452c25167ec4 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/records.py:901 
        ctx = open(os.fspath(fd), 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c84dc878c0eef6eb — Filesystem access.
pkgs/python/[email protected]/numpy/_core/src/common/pythoncapi-compat/upgrade_pythoncapi.py:608 
        with open(filename, encoding=encoding, errors=errors, newline="") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1cf3327c03cd682 — Filesystem access.
pkgs/python/[email protected]/numpy/_core/src/common/pythoncapi-compat/upgrade_pythoncapi.py:627 
        with open(filename, "w", encoding=encoding, errors=errors, newline="") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #a3b0283f2cba58de — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:85 
if 'REPO_NAME' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #ab7bff617c9b0905 — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:86 
   REPO_NAME = os.environ['REPO_NAME']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #a1a984c4aa032ef2 — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:91 
if 'current_language' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #7086f8e2e4688cb6 — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:93 
   current_language = os.environ['current_language']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #bfb6ff73ae698af7 — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:106 
if 'current_version' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #8c48679162df0768 — Environment-variable access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:108 
   current_version = os.environ['current_version']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #65771b0465e97ccc — Filesystem access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:59 
    data = open(file, 'r').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #353995b9a687261b — Filesystem access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:73 
        with open(ext_file, 'w') as handler:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #c49b4779a94a097c — Filesystem access.
pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:83 
            data = open(ext_file, 'r').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e612f42b70de08cd — Environment-variable access.
pkgs/python/[email protected]/numpy/conftest.py:60 
os.environ["NUMPY_EXPERIMENTAL_DTYPE_API"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ef8eda335098e76 — Environment-variable access.
pkgs/python/[email protected]/numpy/conftest.py:100 
        os.environ['NPY_AVAILABLE_MEM'] = available_mem

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9d21b91db183811 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/_backends/_meson.py:71 
        return self.build_template_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7da7175a01d3bbea — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/_backends/_meson.py:181 
        meson_build_file.write_text(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1474bc78d7d56e8 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/_src_pyf.py:215 
    with open(source) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af77a6bad8f92495 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/auxfuncs.py:920 
    with open(source) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2088cd1c2171b13f — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/capi_maps.py:158 
        with open(f2cmap_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4684fe2b053b98cb — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/crackfortran.py:318 
        with open(filename, 'rb') as fhandle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a697d45d2df2f6b7 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/crackfortran.py:329 
    return open(filename, mode, encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad74c8e82876d8f0 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/crackfortran.py:3705 
                open(l).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dc018c54ef0a69a — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/crackfortran.py:3724 
        with open(pyffilename, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5fb140fa60a79d00 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/f2py2e.py:290 
                with open(l):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87a24f678f8b3a3d — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/f2py2e.py:357 
            with open(options['signsfile'], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0183c1b78282be83 — Environment-variable access.
pkgs/python/[email protected]/numpy/f2py/rules.py:161 
generationtime = int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8617b22eb9724921 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/rules.py:1436 
    with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b180897a005bb602 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/rules.py:1443 
        with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #429ae22e52b02c3e — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/rules.py:1451 
        with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #885fdcb20b863ed1 — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/rules.py:1464 
        with open(wn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d45f83ea40f49d4a — Filesystem access.
pkgs/python/[email protected]/numpy/f2py/rules.py:1489 
        with open(wn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a3e779a57496067 — Filesystem access.
pkgs/python/[email protected]/numpy/lib/_format_impl.py:968 
        with open(os.fspath(filename), mode + 'b') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56faefae0b8442d4 — Filesystem access.
pkgs/python/[email protected]/numpy/lib/_format_impl.py:973 
        with open(os.fspath(filename), 'rb') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76fb873df1549333 — Filesystem access.
pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:454 
            fid = stack.enter_context(open(os.fspath(file), "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c34b94edfe126fdd — Filesystem access.
pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:568 
        file_ctx = open(file, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dfbe6e0f7150d7e — Filesystem access.
pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:1549 
        open(fname, 'wt').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e3f892871def0ad — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/clapack_scrub.py:308 
    with open(filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38f5a96e79f6c50a — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/clapack_scrub.py:318 
    with open(outfilename, 'w') as writefo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2ded9927870be6d — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/fortran.py:116 
    with open(filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9de83e885478de3 — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:230 
    with open(wrapped_routines_file) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9772687ae4c49ac0 — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:250 
        with open(filename, 'w') as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f06f055f2fabcf5 — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:256 
    with open(output_file, 'w') as output_fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d24ee19373b43cb — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:258 
            with open(r.filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ad8020e8698ed8b — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:275 
    with open(c_file) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22bf01436ff072e8 — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:278 
    with open(c_file, 'w') as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edb7651a959a1299 — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:301 
        with open(fn) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a417f3b4b1389fc3 — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:309 
    with open('f2c.h') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6571940aa70f90a5 — Filesystem access.
pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:315 
    with open(os.path.join(output_dir, 'lapack_lite_names.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8525ce74c7ba4708 — Filesystem access.
pkgs/python/[email protected]/numpy/ma/mrecords.py:626 
        f = open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e3c182f72ab8c8e — Filesystem access.
pkgs/python/[email protected]/numpy/random/_examples/cffi/parse.py:12 
    with open(os.path.join(inc_dir, 'random', 'bitgen.h')) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ad501d8fb367b5d — Filesystem access.
pkgs/python/[email protected]/numpy/random/_examples/cffi/parse.py:21 
    with open(os.path.join(inc_dir, 'random', 'distributions.h')) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #026049d82c4dcb3c — Filesystem access.
pkgs/python/[email protected]/numpy/testing/_private/extbuild.py:209 
    with open(cfile.parent / "meson.build", "wt") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f20ee84fa794347 — Filesystem access.
pkgs/python/[email protected]/numpy/testing/_private/extbuild.py:223 
    with open(native_file_name, "wt") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89258a7bd58afae1 — Filesystem access.
pkgs/python/[email protected]/numpy/testing/_private/utils.py:72 
                np_dist.read_text('direct_url.json') or '{}',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd8a32623ae67784 — Filesystem access.
pkgs/python/[email protected]/numpy/testing/_private/utils.py:179 
            with open(_proc_pid_stat) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65fed5bf611e566c — Filesystem access.
pkgs/python/[email protected]/numpy/testing/_private/utils.py:208 
            with open(_proc_pid_stat) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d5f40232abb7c2f — Environment-variable access.
pkgs/python/[email protected]/numpy/testing/_private/utils.py:2711 
    env_value = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfffb4108d2cc1db — Filesystem access.
pkgs/python/[email protected]/numpy/testing/_private/utils.py:2763 
        with open('/proc/meminfo') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #461c45f9e7adc414 — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:57 
        with open(self.path, "r") as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3b54319b1c2e777d — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:66 
        with open(self.path, 'r') as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #796f97f98ced617d — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:96 
            with open(os.path.join(root, self.clean_path(path)), "w") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7e493df8d8ead6fe — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:97 
                source.write_text(fd)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0ad105acb92e2636 — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:101 
            with open(
                os.path.join(root, self.clean_path(path) + ".html"), "w"
            ) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4237843bb0e17ad0 — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:106 
        with open(os.path.join(root, 'index.html'), 'w') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8a6e6e639c4b2c66 — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:165 
        with open(log_file, 'r') as log_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6b439d54ec254edf — Filesystem access.
pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:176 
        files.write_text(args.directory)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d28489f0e3afe40f — Filesystem access.
pkgs/python/[email protected]/tools/check_installed_files.py:108 
    with open(os.path.join('build', 'meson-info',
                           'intro-install_plan.json'), 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bca11ff095a41e13 — Filesystem access.
pkgs/python/[email protected]/tools/check_openblas_version.py:48 
        with open(reqfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6b1e126c99715974 — Filesystem access.
pkgs/python/[email protected]/tools/check_python_h_first.py:77 
    with open(name_to_check) as in_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e9301762311aaf6c — Filesystem access.
pkgs/python/[email protected]/tools/functions_missing_types.py:101 
        with open(module_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c728863e089b42ae — Filesystem access.
pkgs/python/[email protected]/tools/get_submodule_paths.py:12 
    with open(gitmodule_file) as gitmodules:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b654a77e1a749935 — Filesystem access.
pkgs/python/[email protected]/tools/get_submodule_paths.py:19 
    with open(
            os.path.join(root_directory, ".gitattributes"), "r"
    ) as attr_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #249858747e0e134e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:21 
        data = json.loads(path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4a9d046dbb777b0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:83 
        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #abedf6d0682e7a36 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:100 
        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5e0664369112f6b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:140 
        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fed633b84996413e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/extensions/refman_links.py:128 
        raw = Path(self._data_file).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #46a30ddb6d0b3da5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/genrelnotes.py:71 
            snippet = snippetfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1bf65be1f7429fcc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/jsonvalidator.py:146 
    root_tmp = json.loads(args.doc_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #21e383a62574f63f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorjson.py:115 
        self.out.write_text(json.dumps(data), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #01b72f870a3c5868 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorman.py:65 
        self.path.write_text(self.text, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e58df89f96182f7f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:116 
        out_file.write_text(data, encoding='ascii')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #dc9af2ea94da33ed — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:129 
            template=template_file.read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #939251119dd29570 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:360 
        raw = self.sitemap_in.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #920941acc4bdf68c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:371 
        self.sitemap_out.write_text(out, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d5918b390213c7e2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:393 
        self.link_def_out.write_text(json.dumps(data, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #197c7a6fcd9d81a8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorvim.py:30 
            template=template_file.read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3446b943ef38c78c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorvim.py:37 
        out_file.write_text(result, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9f4fffb5298c9593 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/loaderbase.py:194 
        return f.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1a5fa36fee991121 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/loaderpickle.py:16 
        res = pickle.loads(self.in_file.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #74e43c8527579f44 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/refman/main.py:76 
        args.depfile.write_text(out_text, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5ab54e6c3c623407 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/docs/validatelinks.py:24 
    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #8ba5af33bab48e6c — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/vendored-meson/meson/manual tests/4 standalone binaries/build_windows_package.py:14 
    response = urllib.request.urlopen(sdl_url, timeout=600.0)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #4f1826c33f57d315 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/manual tests/4 standalone binaries/build_windows_package.py:16 
    open(sdl_filename, 'wb').write(data)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7ab91013a2b3b4c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:454 
            return open(outfileabs_tmp, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f8eb9ebf49ec392 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:623 
            with open(rsp_file, 'w', encoding='utf-8', newline='\n') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b966aeb09b08a216 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:727 
        with open(exe_data, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc1733a9b145050b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:734 
        with open(test_data, 'wb') as datafile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff320520e6a99469 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:737 
        with open(benchmark_data, 'wb') as datafile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a80342c8c2253dd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:902 
        with open(pch_file_tmp, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b777f314f4c7e89 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1314 
        with open(ifilename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b56cfde7d1ce71c7 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1345 
        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f88de98fc8679a4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1676 
        with open(install_data_file, 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20bb8e5e8470598b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:548 
                return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0581b74111484854 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:553 
            return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ba3bef31283984b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:557 
        with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98cf9e2af01b970d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:590 
                    with open(tempfilename, 'ab') as binfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d1dcfed77822893 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:592 
                    return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc4a9277eb217a67 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:634 
        with open(tempfilename, 'w', encoding='utf-8') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d29a8da524a9c288 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:716 
        with open(os.path.join(self.environment.get_build_dir(), 'rust-project.json'),
                  'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a458a617889e7595 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:748 
            with open(os.path.join(builddir, 'compile_commands.json'), 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9675d4c17af5dcdb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1169 
            with open(pickle_abs, 'rb') as p:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11c1b9b08d447356 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1174 
            with open(pickle_abs, 'wb') as p:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #caf92448180a64a9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1505 
        with open(manifest_fullpath, 'w', encoding='utf-8') as manifest:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e603a31891289a2f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:2896 
            with open(filename, encoding='ascii', errors='ignore') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1639e904cee2676d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:3377 
                in_file = Path(os.environ['VCToolsInstallDir']) / 'modules/std.ixx'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1357f7518bb78dbb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:3934 
        with open(d_file, 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fe953bbcf19e0b3 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:36 
    vs_version = os.getenv('VisualStudioVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c96081ad2a587bae — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:37 
    vs_install_dir = os.getenv('VSINSTALLDIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62ea4e0524facfd3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:300 
        with open(Vs2010Backend.get_regen_stampfile(build_dir), 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cb85cf651c08c58 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:304 
        has_arch_values = 'VSCMD_ARG_TGT_ARCH' in os.environ and 'VSCMD_ARG_HOST_ARCH' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0b115f593c3fa5f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:307 
        if 'VCINSTALLDIR' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #682a37465cd7a7b2 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:308 
            vs_version = os.environ['VisualStudioVersion'] \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #966956b96f111921 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:309 
                if 'VisualStudioVersion' in os.environ else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce5a8d9b3c30d0d7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:311 
            script_path = os.environ['VCINSTALLDIR'] + relative_path + 'vcvarsall.bat'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c00e41fd144da85 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:314 
                    target_arch = os.environ['VSCMD_ARG_TGT_ARCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4282c88e25d031e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:315 
                    host_arch = os.environ['VSCMD_ARG_HOST_ARCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c58dfb4fc68c26e8 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:317 
                    target_arch = os.environ.get('Platform', 'x86')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1de3ba5e3cfcda46 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:323 
        if 'VS150COMNTOOLS' in os.environ and has_arch_values:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13ecda7ec6e7b2bc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:324 
            script_path = os.environ['VS150COMNTOOLS'] + 'VsDevCmd.bat'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f81be87b728eac1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:327 
                    (script_path, os.environ['VSCMD_ARG_TGT_ARCH'], os.environ['VSCMD_ARG_HOST_ARCH'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71f4a1c182d4bbba — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:426 
        with open(sln_filename_tmp, 'w', encoding='utf-8-sig') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f0363bcf0682beb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:1008 
        with open(ofname_tmp, 'w', encoding='utf-8') as of:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6298c8bdba6f2fd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:2110 
            with open(rulefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d3b5c90663fa52e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2017backend.py:44 
        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a719dd683beae5b — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2019backend.py:39 
        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ae76756fc3fc35f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2022backend.py:39 
        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40bf05683725ba80 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2026backend.py:39 
        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5971991a597d27ad — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/xcodebackend.py:274 
        with open(tmpname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04d25f7aa31a2207 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/build.py:3601 
        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6d63252940f19f0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cargo/toml.py:41 
            with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0947f49b568d59ec — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/executor.py:216 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aeb7a9fccf856d59 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:51 
        query_file.write_text(json.dumps(query, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f87f1394950f837a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:75 
        debug_json.write_text(json.dumps(index, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fea5b47faa63f9c8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:320 
        data = json.loads(real_path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e3ecad4d0f882b3 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/interpreter.py:884 
            os_env = environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8f61d8cb8fa5130 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:61 
        self.toolchain_file.write_text(self.generate(), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e46944087c18d302 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:62 
        self.cmcache_file.write_text(self.generate_cache(), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e66472610546656f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:238 
        cmake_file.write_text(cmake_content, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30213816628f15ae — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:242 
        temp_toolchain_file.write_text(CMakeToolchain._print_vars(self.variables), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b8f3934e3409d3d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/traceparser.py:170 
            trace = self.trace_file_path.read_text(errors='ignore', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25acf43cec917a09 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmdline.py:93 
    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f20b28d41f09a004 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmdline.py:112 
    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54452a816ab0720e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:866 
                with open(srcname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fb33fdc28f321ab — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:907 
            os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ff388e5367c2871 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:1277 
        with open(os.path.join(work_dir, sourcename), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68fff19764126a03 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:308 
            if 'WATCOM' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e4742ee3b04d017 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:312 
                watcom_cls = [sanitize(os.path.join(os.environ['WATCOM'], 'BINNT', 'cl')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8437d448398aa244 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:313 
                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT', 'cl.exe')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d4e059f65a783d5 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:314 
                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT64', 'cl')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de81fe1ee89681a8 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:315 
                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT64', 'cl.exe'))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c09335e80e1c8e51 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:1355 
            default_path = os.path.join(os.environ['ProgramFiles'], 'NASM')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04636ddcd2e629c6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:228 
                    with open(file_to_check, 'rb') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c805f51e77b1bb9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:881 
            with open(p.output_name, 'rb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb6de1393d984841 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:1197 
        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19d8de2afd53babf — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:42 
        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57191547fee8d2f6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:53 
        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03fedfa47839a519 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:65 
        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e23a10803539da7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/gnu.py:323 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45610204733d0354 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/visualstudio.py:316 
        if 'INCLUDE' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #710b372c48b8fba3 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/visualstudio.py:318 
        return os.environ['INCLUDE'].split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33de0f9b549fbcff — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:292 
                    with open(f, encoding='utf-8') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac2af438f30d896b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:293 
                        with open(fcopy, 'w', encoding='utf-8') as wf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e41aa2ec4328ef19 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:303 
                    os.environ.get('XDG_DATA_HOME', os.path.expanduser('~/.local/share')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54e3a2c385088f3d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:304 
                ] + os.environ.get('XDG_DATA_DIRS', '/usr/local/share:/usr/share').split(':')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c03f94cfe002883d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:489 
    with open(tempfilename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #322e5d55f948e1d9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:784 
        deploy_target = os.environ.get('MACOSX_DEPLOYMENT_TARGET', macos_version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c42063c9fdb923fc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:800 
        deploy_target = os.environ.get('IPHONEOS_DEPLOYMENT_TARGET', ios_version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37afa01951fa6f6f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:939 
        _m = os.environ.get('MKLROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0286c1458aeb161 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/boost.py:762 
        raw = hfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f00c4bd28a94a18 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:298 
        for i in os.environ.get('PATH', '').split(os.pathsep):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #453e80e9afa0dd02 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:329 
        env_path = os.environ.get(f'{name}_DIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41ef53f6f7cf5278 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:580 
        cmake_txt = importlib.resources.read_text('mesonbuild.dependencies.data', cmake_file, encoding = 'utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9ddf4fabd95a8e7 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:600 
        cm_file.write_text(cmake_txt, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14194eb460114b72 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:175 
        env_vars = [var for var in env_vars if var in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #139e904701c4063b — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:176 
        user_defaults = {os.environ[var] for var in env_vars}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08d5a5ecbd626e47 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:182 
        return ([(os.environ[self.env_var], True)] if self.env_var else []) \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f469e287bdafb50 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:186 
        env_vars = os.environ.keys()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6822b49ee1b2c836 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:187 
        return [(os.environ[var], False) for var in env_vars if var.startswith('CUDA_PATH_')]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d36a01bcd210cf9b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:223 
            raw = i.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d0e4f90e8acc679 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:241 
            with open(version_file_path, encoding='utf-8') as version_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0f7718e2600b971 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/dev.py:777 
        vsdir = os.environ.get('VSInstallDir')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea952bbadc210bdc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:110 
            os.environ[f'HDF5_{cenv}'] = join_args(compiler.get_exelist())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #402a3c9c8602eb8d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:111 
            os.environ[f'HDF5_{lenv}LINKER'] = join_args(compiler.get_linker_exelist())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9e47a27846eb5bd — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:114 
            del os.environ[f'HDF5_{cenv}']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f135635e4ec5e723 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:115 
            del os.environ[f'HDF5_{lenv}LINKER']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ff9c5fd073e7703 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:54 
        tool_names = [os.environ.get(env_name) for env_name in env_vars]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66fd4f729c089e7e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:244 
        incdir = os.environ.get('MSMPI_INC')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a919e920db13c05 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:248 
            libdir = os.environ.get('MSMPI_LIB32')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d755f14904d4712a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:251 
            libdir = os.environ.get('MSMPI_LIB64')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c332ee3d37cd9bdc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:278 
        rootdir = os.environ.get('I_MPI_ROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #006e5cda38872d75 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:164 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90ad0cd8b5e8c824 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:181 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac9227b6a7fa602c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:302 
        env = env or os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f41f5a716215a86f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:560 
        with open(la_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3bc48317c6c8e65 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/python.py:98 
            self._data = json.loads(self._path.read_text(encoding='utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edc79c6c2fb84141 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/python.py:229 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd2e2b1cce00a820 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/scalapack.py:57 
        _m = os.environ.get('MKLROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7441bfbb89b851c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/ui.py:119 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76788158c4e74b85 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/ui.py:185 
        self.vulkan_sdk = os.environ.get('VULKAN_SDK', os.environ.get('VK_SDK_PATH'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e673383332abd0b — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/envconfig.py:725 
    return os.environ.get('MSYSTEM_CARCH', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0b1339d59570953 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/environment.py:70 
        value = os.environ.get(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0041d58e476025d4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:385 
        if 'MESON_UNIT_TEST' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #256aa86ea7ed2879 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:387 
        if 'MESON_RUNNING_IN_PROJECT_TESTS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64ca17e4a0e96d29 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:967 
        with open(meson_filename, "w", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f42a6cce9d817bb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:1250 
                ver_data = Path(ifname).read_text(encoding='utf-8').split('\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b820f1f0cda9dd0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:2814 
                with open(dst_tmp, 'w', encoding=file_encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a4127bb9fdfc70b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:2821 
                with open(depfile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #374687081600a826 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreterobjects.py:264 
        child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e24381f117134bc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106 
            with open(fname, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc25a1948b2c8200 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155 
                    with open(parent / 'meson.build', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84caa1ddc1a56b63 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676 
            with open(option_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52f664cb468279de — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/machinefile.py:30 
                with open(fname, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39540f4d7e42ba5a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mcompile.py:253 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba6354a0fcfb0794 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mconf.py:95 
                    with open(opfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fd66b2c75c920b4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mconf.py:110 
                        with open(opfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca976724cfe6eb67 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:72 
    env = {} if dump_fmt else os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #355a3035824bcddb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:153 
            gdbinit_path.write_text(gdbinit_line, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7940ee94b0cab506 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:199 
            with open(options.dump, "w", encoding='utf-8') as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0927087416a129c1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:217 
        if os.environ.get("MESON_DISABLE_PS1_OVERRIDE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6080ab603e571015 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:219 
        shell_env = os.environ.get("SHELL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71d909d0d28879d7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:233 
                args = [os.environ.get("COMSPEC", r"C:\WINDOWS\system32\cmd.exe")]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e3c45643269193f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:236 
            args = [os.environ.get("SHELL", os.path.realpath("/bin/sh"))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9478a4fca73a45fd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:263 
            with open(os.path.join(tmpdir.name, '.zshrc'), 'w') as zshrc: # pylint: disable=unspecified-encoding

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88b87476e0fbd235 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:68 
    m.update(open(fname, 'rb').read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd5a0639fbb933f4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:69 
    with open(hashname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd92a48be03fbd92 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:96 
            if 'GITLAB_CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5386a489c5b2f9a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:261 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e1369bb5e9ca670 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:294 
            with lzma.open(xzname, 'wb') as xf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #640c977b2729a4c4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:299 
            with bz2.open(bz2name, 'wb') as bf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c4575bbbf9262f9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:304 
            with gzip.open(gzname, 'wb') as zf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db0cf7ca98066bca — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:324 
    myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be93d3a5d2a540bc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesondata.py:21 
            data = importlib.resources.read_text( # [ignore encoding] it's on the next lines, Mr. Lint
                    ('mesonbuild' / self.path.parent).as_posix().replace('/', '.'),
                    self.path.name,
                    encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3ac12cbf0ac5dfc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesondata.py:25 
            path.write_text(data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #756dba1223d6fb18 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:33 
        if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ce1a795dfbb07ed — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:43 
        if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cda4f986c92c3f0c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:257 
    if os.environ.get('MESON_SHOW_DEPRECATIONS'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0979c5b5e0a03316 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:264 
    if sys.version_info >= (3, 10) and os.environ.get('MESON_RUNNING_IN_PROJECT_TESTS'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f95e19be29868fc7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:282 
    if sys.platform == 'cygwin' and os.environ.get('MSYSTEM', '') not in ['MSYS', '']:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25779fc63f75fc7e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mformat.py:38 
            self.read_string(f'[{self.default_section}]\n' + filename.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cfb7aac8e68054c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mformat.py:1089 
                code = src_file.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #003d2c18a855b28d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:545 
            destdir = os.environ.get('DESTDIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #694ed0e3631784df — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:551 
            os.environ['DESTDIR'] = destdir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc0ad7a22643a3be — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:581 
                os.environ.get('MESON_ROOT_CMD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f26c3c5315a1033 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:587 
            if rootcmd is None and pkexec is not None and 'PKEXEC_UID' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de53dad6d72b0990 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:814 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd3c374a5649aeec — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:816 
            if os.environ.get('SUDO_USER') is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #057adee3d81d4b11 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:825 
            elif os.environ.get('DOAS_USER') is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ccac5a3e367a8c58 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:879 
    with open(os.path.join(log_dir, 'install-log.txt'), 'w', encoding='utf-8') as lf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fae7fa2e676cb501 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:511 
    with open(get_info_file(infodir, kind), encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07ec70a9ee63d97a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:580 
        with open(tmp_file, 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13d22dd9d3ad081f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:650 
    with open(tmp_file, 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #466908828603273f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:50 
    return bool(kernel.SetConsoleMode(stdout, mode.value | 0x4) or os.environ.get('ANSICON'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8645d8ab4a289da — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:52 
_in_ci = 'CI' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e8744a85dce12e8 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:53 
_ci_is_github = 'GITHUB_ACTIONS' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff4513aceb8a1dd6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:128 
        if 'PAGER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b9f601a7f4f76f1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:129 
            pager_cmd = shlex.split(os.environ['PAGER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2165c39a316cfc41 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:148 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93dd2eadfa49ad41 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:158 
            if 'PAGER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #198b3c55a05b8a84 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:174 
        self.log_file = open(os.path.join(logdir, self._LOG_FNAME), 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d05b954679c9324 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:175 
        self.slog_file = open(os.path.join(logdir, self._SLOG_FNAME), 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea36d5b797476757 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:406 
                _colorize_console = os.isatty(output.fileno()) and os.environ.get('TERM', 'dumb') != 'dumb'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e99bf719eb8af68 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:582 
    elif 'MESON_FORCE_SHOW_LOGS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72da5a3e0b9ff702 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:589 
    with open(fname, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79eda758246783be — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/_qt.py:817 
        with open(fileout_abs, 'w', encoding='utf-8') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd4a16a110879b3c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/cmake.py:338 
            with open(infile, encoding='utf-8') as fin:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d598c1ace78e391e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/cmake.py:352 
        with open(outfile_tmp, "w", encoding='utf-8') as fout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebfb143eb3c8fc2d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/dlang.py:74 
            with open(config_path, encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92d920fc3ffe96b1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/dlang.py:115 
        with open(config_path, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7a70b1f73d70241 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/external_project.py:155 
        self.run_env: EnvironOrDict = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f51ac2f4e8c7fcef — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/external_project.py:220 
            output = open(logfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a366f4a86873e8a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/features/module.py:680 
        with open(config_path, "w", encoding='utf-8') as cout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b255020bb00a48b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/fs.py:169 
        with open(file, mode='rb', buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a4932fd31a9af7c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/fs.py:268 
            with open(path, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ff4116df4759f7b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/gnome.py:950 
        with open(gir_filelist_filename, 'w', encoding='utf-8') as gir_filelist:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e68f8f1614d2cabb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/gnome.py:2212 
        with open(fname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ad98999e2cca659 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/hotdoc.py:293 
        with open(hotdoc_config_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f518014fb4da7f0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/i18n.py:238 
        rsp_file.write_text(source_list, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be288f84195fd8c6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/keyval.py:31 
            with open(path_to_config, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36d22325f547b461 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/pkgconfig.py:555 
        with open(fname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d083e0315cc0b26 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/python.py:431 
        with open(pycompile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c8a857ea16dd6ab — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/python.py:442 
                with open(os.path.join(self.interpreter.environment.get_scratch_dir(), manifest), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3153dd59d45b18f4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/snippets.py:100 
        header_path.write_text(content, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d425b8743e8d263e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mparser.py:113 
        self.in_unit_test = 'MESON_RUNNING_IN_PROJECT_TESTS' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #682ee60ba0e1164b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:152 
        with open(os.path.join(build_dir, '.gitignore'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d6f44f7e2e4c316 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:154 
        with open(os.path.join(build_dir, '.hgignore'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2d2f64c1d0ce795 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:324 
                with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4249e0f57f189eab — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:527 
        self.file = open(filename, 'w', encoding='utf-8', errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8f21cdc0d7c8f52 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:762 
        inherit_env = env_tuple_to_str(os.environ.items())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2babcf68d89344f5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:956 
        with open(self.filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5598773f37cb0d9f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1057 
        test_only_env = set(self.env.items()) - set(os.environ.items())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #057dc4bb33d73227 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1121 
            with open(filename, 'r', encoding='utf8', errors='replace') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f82650b1414e9f42 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1794 
        return current.env.get_env(os.environ.copy())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94bbb9d0e76e8334 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1802 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7dc380f84127b9a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:2237 
        with open(targets_file, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cde436a297deb949 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:2319 
            if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e49ef219078f8a2e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/optinterpreter.py:83 
            with open(option_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0707da3a8b87a019 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:185 
        if 'USERPROFILE' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ee13dd7d3eb365f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:196 
        appstore_dir = Path(os.environ['USERPROFILE']) / 'AppData' / 'Local' / 'Microsoft' / 'WindowsApps'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6cf736d481e3a23 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:228 
            with open(script, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6ebc88351ee368f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:332 
        search_dirs = OrderedSet(self._windows_sanitize_path(os.environ.get('PATH', '')).split(';'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1d7bc7db84084bc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:354 
        path = os.environ.get('PATH', os.defpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc06914cd434178b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1022 
                with open(fpath, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #183a0ec3f6198aa4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1024 
            with open(fpath, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95d318b6f02b45a3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1075 
            with open(val['path'], 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #025cc1a6c3c7d833 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1144 
        with open(options.json, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #55b2366b54e8f1e8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/clangformat.py:26 
            original = fname.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8c77ef6df0979fa2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/cleantrees.py:30 
    with open(args[0], 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #967ecc7f26315448 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/coverage.py:103 
                    with open(llvm_cov_shim_path, 'w', encoding='utf-8') as llvm_cov_bat:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #67b4f5dc309603db — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/coverage.py:107 
                    with open(llvm_cov_shim_path, 'w', encoding='utf-8') as llvm_cov_sh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #88d75a220d782da6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:105 
    with open(outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e85652600d3a21ba — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:119 
    with open(jsonfile, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c6b610fe440e2b48 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:125 
        with open(dep, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e32c0ac94b028550 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:159 
            self.bf = open(bfile, 'r+b')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0ee70eca74419a28 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:164 
                self.bf = open(bfile, 'r+b')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #197b3d8cc5888532 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:523 
    with open('META-INF/MANIFEST.MF', 'r+', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6f278482a19af87c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:72 
        with open(pickle_file, 'rb') as pf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a5f2c5392f7b92de — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:90 
        for line in fpath.read_text(encoding='utf-8-sig', errors='ignore').split('\n'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d127a005f85bb1b4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:134 
        for line in fpath.read_text(encoding='utf-8-sig', errors='ignore').split('\n'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f60378bcaafd4b90 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:199 
        with open(self.outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c615fd641cd7d8da — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:100 
    cppflags = shlex.split(os.environ.get('CPPFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #91369070fa7403e2 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:101 
    cflags = shlex.split(os.environ.get('CFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #77d86053826c9784 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:102 
    cxxflags = shlex.split(os.environ.get('CXXFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6451d8d6152e8089 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:103 
    objcflags = shlex.split(os.environ.get('OBJCFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #47471ff9c34fffbc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:104 
    objcxxflags = shlex.split(os.environ.get('OBJCXXFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #82412c72906b5bef — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:105 
    ldflags = shlex.split(os.environ.get('LDFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #da2a76dd34356673 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:278 
    with open(tmpfilename, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b77d0fe877ef9288 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:329 
        compile_args = shlex.split(os.environ.get(compilers.CFLAGS_MAPPING[langname] + envvar_suffix, ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ff9629f73c3f4cd9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:331 
        cppflags = tuple(shlex.split(os.environ.get('CPPFLAGS' + envvar_suffix, '')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c3014afe466ca558 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:337 
        lang_link_args += shlex.split(os.environ.get('LDFLAGS' + envvar_suffix, ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e1c17f7050ce30e8 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:345 
            compilerstr = os.environ.get(envvarname + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e458630f8d3f6844 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:365 
            binstr = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b497115f94e46b6a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:371 
    var = os.environ.get('PKG_CONFIG_LIBDIR' + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e15bdb957fb2a64a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:374 
    var = os.environ.get('PKG_CONFIG_SYSROOT_DIR' + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ba14685ee887a3f5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:523 
            with open(pathlib.Path(self.options.outfile) / crossfile_name, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3d2e8fcdecfcbd19 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:28 
        with open(self.depfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fffbd036313d2abf — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:39 
        with open(self.stampfile, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #37ce56317215b99b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:74 
            output = open(logfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #737ab2a3e7eb8580 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:79 
        run_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5da679e70ea1a54f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gettext.py:30 
        with open(linguas, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #518bbc46d472b188 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gettext.py:48 
    child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #034f5bbe04b8b925 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:52 
    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b75dec8112ddd4b9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:270 
    if 'MESON_INSTALL_PREFIX' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a1a27e4c824ba039 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:271 
        destdir = os.environ.get('DESTDIR', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4493c4f407338100 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:272 
        install_prefix = destdir_join(destdir, os.environ['MESON_INSTALL_PREFIX'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #62b9c2a9748db34a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/hotdochelper.py:23 
    subenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cc4316abab30a373 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/hotdochelper.py:35 
        destdir = os.environ.get('DESTDIR', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b63fcee721da6709 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/itstool.py:64 
    build_dir = os.environ.get('MESON_BUILD_ROOT', os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1dd16591a02c2348 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:31 
    child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a91ef78209ba582d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:49 
        stdin = open(exe.feed, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #82d8f71d50445cdf — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:84 
            with open(exe.capture, 'rb') as cur:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #dea1d2bc7173d14d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:89 
            with open(exe.capture, 'wb') as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #091462fa9f4d8747 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:106 
        with open(options.unpickle, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #92348cbb6d6206b6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/msgfmthelper.py:25 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #48fe3bb528ef1c8e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pickle_env.py:6 
    with open(args[0], "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #07ff015341a8ae27 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pickle_env.py:7 
        pickle.dump(dict(os.environ), f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a4807ebb06b188d9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:12 
quiet = int(os.environ.get('MESON_INSTALL_QUIET', 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f00668d849c72113 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:22 
        fullpath = absf = os.environ['MESON_INSTALL_DESTDIR_'+key] + f

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6aed91fe55eaec65 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:23 
        f = os.environ['MESON_INSTALL_'+key] + f

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ef592367eaff52b5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:41 
    with open(data_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d4cdb62884030099 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/regen_checker.py:41 
    with open(dumpfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #717fe34435c06533 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/regen_checker.py:44 
    with open(coredata_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b35ed3884ba2002d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/reprotest.py:61 
        os.environ['CCACHE_DISABLE'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3af41d44d122eb94 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/run_tool.py:136 
    with open('meson-info/intro-targets.json', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1eac5ddcedd5161f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/run_tool.py:156 
    with open('meson-info/intro-targets.json', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e80c7336d520de0d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/rustdoc.py:57 
                environ = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2e3c2f0f637eb0c9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:31 
    with open(outfilename, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8eafbe3c377999f4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:36 
        with open(outfilename, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b901c4d34a0e73f9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:42 
    with open(outfilename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #eda925d54c607ca1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:53 
    with open(TOOL_WARNING_FILE, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #16c4af057d4cab6d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:58 
    if evar in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a949ce414cf37fbf — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:60 
        return shlex.split(os.environ[evar])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #41f2d577ae41ff9a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:118 
    origpath = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b2471e7b7a5e4bff — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:120 
        os.environ['PATH'] = '/usr/gnu/bin:' + origpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #db3c2c0410ee5b53 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:123 
        os.environ['PATH'] = origpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0e9362db0ca55c1c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:228 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e0bad2360630130a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:333 
            with open(TOOL_WARNING_FILE, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bc5cf15f13316020 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/uninstall.py:14 
    for line in open(log, encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d5f615b5eb5b3302 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:16 
    with open(infile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9b2aba98565e74ca — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:19 
        with open(outfile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ef94db382a723b45 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:24 
        with open(outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2357a173a253e0c3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/yasm.py:21 
    with open(options.depfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea2a3e834bdea8a7 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:96 
            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d93874c148bf842a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:100 
            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #121b8f37ca55448e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:128 
            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aad451c6dfcbb26e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:131 
            with open(test_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7167427813524c91 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:134 
            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a9cafd1bc7612ff — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:148 
            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #863972fc18fe418e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:151 
            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51c3094f26855efe — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:188 
            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c6c79e16c0807d5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:191 
            with open(test_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81a3e7b6abf10d05 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:194 
            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #582b03f0070fea50 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:219 
            with open(kwargs['header_file'], 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6d05685c9ebab63 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:106 
    env_ninja = os.environ.get('NINJA', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a3327b2087ed45e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:193 
    if 'SCANBUILD' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c13799a94a7b3f97 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:194 
        exelist = split_args(os.environ['SCANBUILD'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f6b1d4eea2e7bdb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/platform.py:49 
                self.lockfile = open(self.lockpath, 'w+', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4d967e276d7417d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/platform.py:98 
                self.lockfile = open(self.lockpath, 'w+', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d44fd8afd82b806a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:247 
    if 'MESON_COMMAND_TESTS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84df160b2e784d0d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:752 
    arch = os.environ.get('PROCESSOR_ARCHITEW6432', '').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6da008a85454656 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:756 
            arch = os.environ['PROCESSOR_ARCHITECTURE'].lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #580a58e71db3b06c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:836 
    vsver = os.environ.get('VSCMD_VER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a71e34110dc04d81 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1124 
        if varname in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #194c7f93c026165b — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1126 
                num_workers = int(os.environ[varname])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd681afb172b36fb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1543 
        with open(src, encoding=encoding, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e189a6efd8a7865 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1551 
        with open(dst_tmp, 'w', encoding=encoding, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b1aeec95bded630 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1612 
    with open(ofilename_tmp, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03401c1101f680f8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1627 
        with open(dst, 'rb') as f1, open(dst_tmp, 'rb') as f2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d154f3ccc672987b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1717 
            with open(args_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a503dd1a0133cc37 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:2429 
        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f7dd376ea77d1ef — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:2490 
    return int(os.environ.get('MESON_RSP_THRESHOLD', limit))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fc1331b412108ed — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:31 
    if os.environ.get('OSTYPE') == 'cygwin':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6528dc1ec94785e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:33 
    if 'MESON_FORCE_VSENV_FOR_UNITTEST' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c641c4907097752 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:36 
        if 'VSINSTALLDIR' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #154b905afcb72920 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:51 
    root = os.environ.get("ProgramFiles(x86)") or os.environ.get("ProgramFiles")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb02db09c498c6d4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:98 
        with open(env_file.name, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f66bd4c2531bd0e6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:101 
            os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ea3b0fea7a8cf4f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:172 
    with open(wrapfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f3557cbdbc8eaa4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:285 
        with open(filename, 'r', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1daa32f058e22d53 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:344 
            with open(self.get_hashfile(subproject_directory), 'w', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c38bcfe0b8bb7a19 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:378 
        self.cachedir = os.environ.get('MESON_PACKAGE_CACHE_DIR') or os.path.join(self.subdir_root, 'packagecache')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de49dbe8785cf883 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:539 
                with open(main_fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c6b466f221ec42f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:730 
            with open(hashfile, 'r', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #882ec543afceb98b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:861 
        with open(path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a09c4c141b42163d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wraptool.py:102 
    with open(wrapfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15ff7f264f215017 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wraptool.py:207 
    with open(os.path.join(subproject_dir_name, 'wrapdb.json'), 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d3910a04a702ff6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:234 
        with open(self.main_xml, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5293c486a3a6f9b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:237 
        with open(self.main_xml) as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae95b3fed36e5eca — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:240 
        with open(self.main_xml, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48fbf748ee6d9d53 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/packaging/createpkg.py:94 
        with open(self.distribution_file, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5b2efef909d26b2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:42 
version_lines = pathlib.Path(relfile).read_text().split('\n')[:-1]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3a73e3b4a52f58c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:59 
    myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a87a8111c250bfd9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:62 
    pathlib.Path(relfile).write_text('\n'.join(version_lines) + '\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cce6cff65444005e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/run_cross_test.py:40 
        data = json.loads(cf_path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b17d75a1cc25c1dc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_cross_test.py:43 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #105b786c2c48a67c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/run_format_tests.py:19 
    lines = file.read_bytes().split(b'\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40cda3b131537b40 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:62 
        self.orig_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #475c3baf7511b32c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:64 
        os.environ['MESON_COMMAND_TESTS'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b3f7362b3d53561 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:75 
        os.environ.clear()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c4d6f1a96d30e47 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:76 
        os.environ.update(self.orig_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f64b2eac74080e51 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:133 
        os.environ['PATH'] = str(bindir) + os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c87b5b28208e86c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:151 
        os.environ['PYTHONPATH'] = os.path.join(str(pylibdir), '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02307b62f3fd881f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:152 
        os.environ['PATH'] = str(bindir) + os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70ceb3e91c77ad6d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:163 
            os.environ['PYTHONPATH'] = os.pathsep.join(PYTHONPATHS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8609f7420e6e0334 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:196 
        wrapper.write_text('#!/bin/sh\n\nmeson.real "$@"', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f01502f3d92caf35 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:219 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ddbbeb643890c3a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:221 
        with open(script_file, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf315d06da3a1dd1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_mypy.py:170 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11800f5a94607f4d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:278 
        self.env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5ca6cf8e59b84c6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:310 
print_debug = 'MESON_PRINT_TEST_OUTPUT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcba1ea7bb1eb1e1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:311 
under_ci = 'CI' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a95bf3ed38ec99d0 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:312 
raw_ci_jobname = os.environ.get('MESON_CI_JOBNAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06c151137b709735 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:826 
            if skip_env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b49776e89fefa442 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:837 
        test_def = json.loads(test_def_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1c455a1ace706d9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1042 
    skip_cmake = ((os.environ.get('compiler') == 'msvc2015' and under_ci) or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #397a63e1b86be993 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1099 
    with open(txtname, 'w', encoding='utf-8', errors='ignore') as lf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e47e0ebe8fb3b75d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1636 
    if 'VSCMD_VER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee2555514bf72b3d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1637 
        print('VSCMD version', os.environ['VSCMD_VER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71d68274d4dd2bdc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:52 
    NINJA_1_12_OR_NEWER = bool(int(os.environ['NINJA_1_12_OR_NEWER']))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c868f2c0ef360ba7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:53 
    NINJA_CMD = [os.environ['NINJA']]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #056aecb3e0ce3bb5 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:63 
    os.environ['NINJA_1_12_OR_NEWER'] = str(int(NINJA_1_12_OR_NEWER))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cd94101d294dad8 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:64 
    os.environ['NINJA'] = NINJA_CMD[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bbe3e555c6d50aa — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:72 
os.environ['PYTHONWARNDEFAULTENCODING'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a5e7ec3a5ab6dcc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:74 
os.environ['MESON_RUNNING_IN_PROJECT_TESTS'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e11c0ddf51314a12 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:118 
    if not os.environ.get('MKLROOT', '').strip():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cd4ef11fbb7a5e4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:120 
    if (os.environ.get('CC') == 'icl' or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #602dfefbbc0587a0 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:121 
            os.environ.get('CXX') == 'icl' or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #03a56264504ce466 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:122 
            os.environ.get('FC') == 'ifort'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4266e2d9b00a1e8 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:131 
                 'Please try using the Intel shell.'.format(os.environ.get('MKLROOT')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #704bfb8653b3cc74 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:173 
if 'MESON_EXE' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4350c1c4cfb58c6a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:174 
    meson_exe = mesonlib.split_args(os.environ['MESON_EXE'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e74e089d457a219e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:233 
            with open(f, encoding='utf-8') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5881ac404816597 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:301 
    with mock.patch.dict(os.environ, env or {}), mock.patch.object(sys, 'stdout', stdout), mock.patch.object(sys, 'stderr', stderr):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e412bce0c76b46a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:352 
    if not mesonlib.is_windows() and not mesonlib.is_haiku() and 'CI' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25a60a1b1a51612a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:366 
    if 'APPVEYOR' in os.environ and os.environ['arch'] == 'x86':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9862a4b91d8ccabe — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:367 
        os.environ.pop('platform')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab00a0cc81d2074a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:370 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae74d906b8490000 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_unittests.py:69 
    os.environ['MESON_UNIT_TEST_BACKEND'] = be

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30c90f6b095bcd69 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/run_unittests.py:113 
        if 'CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8e8af58b0ac2d1b — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:13 
    if is_pr_env not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1974fd4cc9bdd8d0 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:16 
    elif os.environ[is_pr_env] == 'false':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3db56788ffbb08f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:22 
    if base_env not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #933b5ae436bd40db — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:25 
    return os.environ[base_env]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea505d8075d21954 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/cmake/11 cmake_module_path/subprojects/cmMod/gen.py:1 
with open('main.c', 'w') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10dd43069e9dc7af — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:12 
input_file = os.path.join(os.environ['MESON_SOURCE_ROOT'], 'raw.dat')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f842a5d16bfd0615 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:13 
output_file = os.path.join(os.environ['MESON_BUILD_ROOT'], 'generated.h')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9ae6de406b8fd93 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:15 
with open(input_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #058570001b9dcc4f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:17 
with open(output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #925930372c41a94b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8 
with open(output, 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79a12dad5ab62703 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:11 
        with open(i) as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6064a5f410d44a72 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen-resx.py:8 
with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e45d7b3685d1a05 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen.py:8 
with open(ifile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1959bdaedae892e8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen.py:12 
with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b93d85f99bfab62c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/109 custom target capture/my_compiler.py:9 
    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc5db3036f94cf63 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/110 allgenerate/converter.py:8 
open(ofile, 'w').write(open(ifile).read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c051c2abd4e56a1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/123 custom target directory install/docgen.py:14 
    with open(os.path.join(out, name + '.html'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58127140d0bb6c71 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/125 configure file in generator/src/gen.py:8 
with open(ifile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aaf75c46d6f5fd73 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/125 configure file in generator/src/gen.py:12 
with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e199feac5e42eb2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/128 build by default targets in tests/write_file.py:5 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d470a5b302bbdf41 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5 
ifile = open(sys.argv[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db46eabad4a63c09 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6 
ofile = open(sys.argv[2], 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7710f0bcdfb00d42 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_custom.py:4 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d24b9c53a88b59f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_generator.py:4 
with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9848c24b7f93d93f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_generator.py:6 
with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cc5f4b99209548f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_env.py:12 
if 'MESONINTROSPECT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60e2831103e549fc — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_env.py:15 
mesonintrospect = os.environ['MESONINTROSPECT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cecd7b514463a132 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:8 
if 'MESONINTROSPECT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #995e2d7faea5deea — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:10 
if 'MESON_BUILD_ROOT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #735d197f393b4025 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:13 
mesonintrospect = os.environ['MESONINTROSPECT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5161e5ba2d217637 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:16 
buildroot = os.environ['MESON_BUILD_ROOT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b961465cf2a598d6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/file_contains.py:14 
    with open(args.file[0], encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #074eda78c4901040 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-deps.py:9 
build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d55de3fcaa2032d6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-deps.py:10 
subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1e52f8dec5b8390 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-without-input-file.py:9 
build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c8dacd57d8dca012 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-without-input-file.py:10 
subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bccd3f90b09e0a9c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator.py:9 
build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4de40bcd14adb757 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator.py:10 
subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d95ec62658dac090 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/140 custom target multiple outputs/generator.py:11 
with open(os.path.join(odir, name + '.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43ece57cbe1a9171 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/140 custom target multiple outputs/generator.py:13 
with open(os.path.join(odir, name + '.sh'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2cf9c787da868077 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/141 special characters/check_quoting.py:27 
    with open(output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05ae121667dd4570 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/144 link depends custom target/make_file.py:4 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfb2e46613067aaf — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/152 index customtarget/gen_sources.py:30 
    with open(args.header, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a7b7a459e2a3261 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/152 index customtarget/gen_sources.py:33 
    with open(args.code, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4608cbbac5b9da37 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:41 
    proto_name = open(ifile_name).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ad1c14f0d7d65a7 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:45 
    open(h_out, 'w').write(h_templ % (proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4400d764f1af1ca3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:46 
    open(c_out, 'w').write(c_templ % (proto_name, proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b506f8cb9302b9e3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/169 source in dep/generated/genheader.py:15 
funname = open(ifile).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c979e7d1b1ed7f7c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/169 source in dep/generated/genheader.py:17 
open(ofile, 'w').write(templ % funname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec85491098cf272c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/170 generator link whole/generator.py:14 
    with open(hname, 'w') as hfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3df38622a2e2b7a1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/170 generator link whole/generator.py:20 
    with open(cname, 'w') as cfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22620822411ab658 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/178 bothlibraries/dummy.py:7 
    Path(sys.argv[1]).write_text('Hello World\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fe16cee470497c8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/179 escape and unicode/file.py:6 
with open(sys.argv[1]) as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e4f769020e7b287 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/179 escape and unicode/file.py:9 
with open(os.path.join(sys.argv[3]), 'w', errors='replace') as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #995a27380a03def9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/182 find override/subdir/converter.py:13 
d = pathlib.Path(ifilename).read_text().split('\n')[0].strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cafe0d6f9eb6fc42 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/182 find override/subdir/converter.py:15 
pathlib.Path(ofilename).write_text(ftempl % d)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07513694ba04cc38 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/186 test depends/gen.py:7 
    with open(sys.argv[1], 'w') as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec5965a391ab9dc4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:41 
    proto_name = open(ifile_name).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5a3af4850fb092e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:45 
    open(h_out, 'w').write(h_templ % (proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0aa3416ad6ae3d1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:46 
    open(c_out, 'w').write(c_templ % (proto_name, proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7330e75922428ba4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/202 custom target build by default/docgen.py:11 
    with open(os.path.join(out, name + '.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fed2cfa8e235b3ec — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/208 link custom/custom_stlib.py:73 
    c_file.write_text(contents)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4335b4a20a62ec43 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/209 link custom_i single from multiple/generate_conflicting_stlibs.py:70 
        c_file.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f62465884e6520a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/210 link custom_i multiple from multiple/generate_stlibs.py:72 
        c_file.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29530e748dbce52c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/216 custom target input extracted objects/check_object.py:16 
    with open(sys.argv[2], 'wb') as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51f314d2afacb0b8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/216 custom target input extracted objects/libdir/gen.py:3 
with open(sys.argv[1], 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b81b2d69740c4606 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/22 object extraction/check-obj.py:12 
    with open('compile_commands.json') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #354b5341f293eba4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/check_arch.py:12 
with open(dummy_output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fb201c0435bf88c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/make_file.py:4 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efe37518ec285ed4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/make_file.py:7 
with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fa0afb946edbf83 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/227 very long command line/codegen.py:6 
Path(sys.argv[2]).write_text(
    'int func{n}(void) {{ return {n}; }}'.format(n=sys.argv[1]))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a29efbd6cf797ade — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2 
with open('x.c', 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d17dc1a34413aa0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4 
with open('y', 'w'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5c0924c60ec9f3d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/242 custom target feed/my_compiler.py:13 
    with open(sys.argv[1], 'w+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94f32b071ccaf068 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5 
assert(Path(sys.argv[1]).read_text() == 'stage1\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b36d311eb5612e1e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6 
Path(sys.argv[2]).write_text('stage2\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ca92fb536539aa5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5 
assert(Path(sys.argv[1]).read_text() == 'stage2\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2c7f46a1de5596e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6 
Path(sys.argv[2]).write_text('int main(void){}\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69e2918a8484066f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/269 configure file output format/compare.py:3 
with open(sys.argv[1], 'r', encoding='utf-8') as f, open(sys.argv[2], 'r', encoding='utf-8') as g:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29196211085f1224 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:5 
ENV_VAR_VALUE = os.environ.get('ENV_VAR_VALUE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb10975fc77386b9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:8 
with open(sys.argv[1], 'r') as infile, \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20c1faf5da540392 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:9 
     open(sys.argv[2], 'w') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c34794b66943a1a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/274 customtarget exe for test/generate.py:12 
    with open(a, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f0435b4663ff0f1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/275 environment/testenv.py:9 
if os.environ.get(key) == expected:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b18c62f54246053 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/275 environment/testenv.py:12 
sys.exit(f'Expected {expected!r}, was {os.environ.get(key)!r}')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22746a4f1089ccd2 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/33 run program/check-env.py:5 
assert os.environ['MY_PATH'] == os.pathsep.join(['0', '1', '2'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c29daf183d3ed65c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:6 
assert os.environ['MESONTESTING'] == 'picklerror'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #388e05d17e1dc0b7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:7 
assert os.environ['TEST_LIST_FLATTENING'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24842f013d6f8bbc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:9 
with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #069b5ad2980e2d13 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/depfile/dep.py:12 
with open(output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f97c6d2faa7b3548 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/depfile/dep.py:14 
with open(depfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #723c6b2ab2dd93a4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:11 
    assert os.environ['MY_COMPILER_ENV'] == 'value'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d1e3c5461a93624 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:16 
    with open(args[1].split('=', 1)[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d61a93e3b27ff8ff — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:21 
    with open(args[2].split('=', 1)[1], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb9fcf5e177ec963 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler.py:9 
    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a63b45896f4df850 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler.py:14 
    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fefb8222a7bf5422 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler2.py:9 
    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ac3e661060846d0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler2.py:14 
    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80eb33a83b67a9f0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/usetarget/subcomp.py:5 
with open(sys.argv[1], 'rb') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa8f9e3e660c66e0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/usetarget/subcomp.py:6 
    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c455758c67047d8 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:6 
assert 'MESON_SOURCE_ROOT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #839e39b4210dd4ee — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:7 
assert 'MESON_BUILD_ROOT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36253200882336a1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:8 
assert 'MESON_SUBDIR' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d83a19fb2869486 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:9 
assert 'MESONINTROSPECT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d434a75d9434fe2 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:10 
assert 'MY_ENV' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6777bd4e482cc714 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:15 
env_source_root = Path(os.environ['MESON_SOURCE_ROOT']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd3149786d089b8c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:16 
env_build_root = Path(os.environ['MESON_BUILD_ROOT']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83a91401ce6ea3aa — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:17 
env_current_source_dir = Path(env_source_root, os.environ['MESON_SUBDIR']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8cdf94b9ae4c6242 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/converter.py:5 
with open(sys.argv[1], 'rb') as ifile, open(sys.argv[2], 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96be87616f5a53dc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/fakeburner.py:9 
    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f67fcc3b5760b34e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/customtarget.py:12 
    with open(os.path.join(args.dirname, '1.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0139df0ea6e34cf2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/customtarget.py:14 
    with open(os.path.join(args.dirname, '2.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7d76a998b2310c9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:7 
prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b0f1d5e7dd38b77 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:8 
dry_run = bool(os.environ.get('MESON_INSTALL_DRY_RUN'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9b18b38313360b6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:30 
                with open(os.path.join(dirname, name), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3962802a3bd67e3 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/src/myinstall.py:6 
prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eab91272e785ef2c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/src/myinstall.py:13 
with open(os.path.join(dirname, sys.argv[2] + '.in'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8dccdda3fbeb4444 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/54 custom target source output/generator.py:10 
with open(os.path.join(odir, 'mylib.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74da254a7597357e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/54 custom target source output/generator.py:12 
with open(os.path.join(odir, 'mylib.c'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a30f43e0f22043c3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/57 custom header generator/makeheader.py:9 
with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #208091459f09c4c9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/57 custom header generator/makeheader.py:11 
with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb220e517e17fb01 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:9 
with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0a8c1376795733f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:16 
with open(outhdr, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5e035ec47358ef4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:18 
with open(outsrc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbb01a37e8d5ca99 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:13 
    with open(infile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23cb9e31b9e45941 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:16 
        with open(outfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc35425c67d6f256 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:22 
    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fa2e8115da13b5e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/69 configure file in custom target/src/mycompiler.py:5 
with open(sys.argv[1]) as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae1e687a052dd39c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/69 configure file in custom target/src/mycompiler.py:8 
with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aee69fb5e47e9fe2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9 
with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #467be753f89bba29 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:11 
with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5e33a598027aef8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9 
with open(files[0]) as ifile, open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfb15c97f27fa158 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/8 install/gendir.py:8 
open(fname, 'w').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #484ea05b48db6cbb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/86 private include/stlib/compiler.py:29 
with open(cfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #263a34baac72a198 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/86 private include/stlib/compiler.py:31 
with open(hfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b9729bebdbb0ef1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/88 dep fallback/subprojects/boblib/genbob.py:5 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d928beff66dd79cd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen.py:21 
with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ef270c6202e86da — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen.py:26 
with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41794a5f2cc660c8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:17 
with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4174f1a0ce15453d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:22 
with open(output_c, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fefdbb6a09ba7ed — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:31 
with open(output_h, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e68d6bd602b76c43 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen3.py:12 
with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f969089e18314d6a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/92 test workdir/subdir/checker.py:5 
data = open(sys.argv[1], 'rb').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #672facd473d15e70 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10 
with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32d5aaddbec9b83a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43 
with open(outc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f699678bd8fc288 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50 
with open(outh, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0419a79c8f3d5ad6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57 
with open(tmpc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff9dd31fa98acdd9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:68 
with open(tmpc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #22217f13c735630b — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:10 
input_file = os.path.join(os.environ['MESON_SOURCE_ROOT'], 'raw.dat')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8912e6938210942c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:11 
output_file = os.path.join(os.environ['MESON_BUILD_ROOT'], 'generated.h')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4531cb6e36c79986 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:13 
with open(input_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b701f7663d471c9a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:15 
with open(output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06f9bd47435019bc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/gen.py:10 
with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d79a0653eff654ae — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/generator.py:11 
with open(args.input) as i, open(args.output, 'w') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1dfa75ab23aa3fd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/libdir/gen.py:10 
with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4c9a440948b5774 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/39 custom target plainname many inputs/catfiles.py:6 
with open(out, 'wb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9af2eda82b234bd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/39 custom target plainname many inputs/catfiles.py:8 
        with open(infile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76522234293bcf95 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:11 
with open(os.path.join(odir, name + '.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e32a8e184dcd5459 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:13 
with open(os.path.join(odir, name + '.c'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e933463521ee3f2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:15 
with open(os.path.join(odir, name + '.sh'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9854c6b4b61271c1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/88 custom target install data/preproc.py:11 
with open(outf, 'wb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ab811f5fedf359f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/88 custom target install data/preproc.py:12 
    with open(inf, 'rb') as i:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee5cd3449b2b09b0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/format/5 transform/file_compare.py:16 
    with open(args.actual, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25eaf679f5c3e332 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/format/5 transform/file_compare.py:18 
    with open(args.expected, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0496de86655e6274 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/fortran/7 generated/gen.py:36 
    with open(args.input, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #375658de3c26ab3d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/fortran/7 generated/gen.py:41 
    with open(args.output, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e281f0daa750740 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/10 gtk-doc/include/generate-enums-docbook.py:52 
        with open(sys.argv[1], 'w') as doc_out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3c962c578ad5d06 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/4 qt/subfolder/generator.py:5 
    with open(sys.argv[1], "w") as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5fcc2ae3a8d8c13d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/6 gettext/data3/verify.py:12 
with open(fname, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36de5bff8d0abbb4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/osx/2 library versions/require_pkgconfig.py:6 
if 'CI' in os.environ or shutil.which('pkg-config'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #830c1b2a49b66e6d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/python/4 custom target depends extmodule/blaster.py:25 
    with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2df2a6790f464be2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/python3/4 custom target depends extmodule/blaster.py:26 
    with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11c7de10d0f6fca9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/rust/11 generated main/gen.py:12 
    with open(args.out, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e2f39f2e755ee8d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/rust/19 structured sources/gen.py:12 
    with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02e26002454f3402 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/2 testsetups/envcheck.py:5 
assert 'PATH' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0b1e701d45df614 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/26 install umask/myinstall.py:6 
prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1743684c71a444a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/26 install umask/myinstall.py:16 
with open(os.path.join(dirname, sys.argv[2]), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35f6794baf2ba8bf — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:10 
source_root = pathlib.Path(os.environ['MESON_DIST_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2779ba11992d5208 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:14 
contents = modfile.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c46ca0a93965f53e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:16 
modfile.write_text(contents)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a15706e1f6187f5e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/subprojects/sub/dist-script.py:11 
source_root = pathlib.Path(os.environ['MESON_PROJECT_DIST_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5a1a370f697e89f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/subprojects/sub/dist-script.py:12 
mesonrewrite = shlex.split(os.environ['MESONREWRITE'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #255857ca2d8a89e7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/45 native dep pkgconfig var/cross_pkgconfig.py:7 
environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf222d7948622d03 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:5 
assert 'ENV_A' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29a0fb2f5e271471 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:6 
assert 'ENV_B' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e052ca7cbda47ad — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:7 
assert 'ENV_C' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e635aec1a37bece — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:9 
print('ENV_A is', os.environ['ENV_A'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89aa6ffdc80f1051 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:10 
print('ENV_B is', os.environ['ENV_B'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b8124a2e38b4b64 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:11 
print('ENV_C is', os.environ['ENV_C'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50fe1f034015836e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/67 test env value/test.py:6 
assert os.environ['TEST_VAR'] == sys.argv[1]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba56f23d197db23d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/70 cross test passed/exewrapper.py:15 
    defined = 'MESON_EXE_WRAPPER' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d50f380b99bf507 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/70 cross test passed/exewrapper.py:18 
        print(os.environ, file=sys.stderr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27eb2646290530c3 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:5 
assert os.environ['MESON_DEVENV'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #271646b5e535b180 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:6 
assert os.environ['MESON_PROJECT_NAME'] == 'devenv'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7d4252116e2d1a2 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:7 
assert os.environ['TEST_A'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c77c3959d381aba9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:8 
assert os.environ['TEST_B'] == '0+1+2+3+4'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a5efebe5713d11d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:9 
assert os.environ['TEST_C'] == os.pathsep.join(['/prefix', '/suffix'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c05c1e1dd9286f74 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/94 custominc/easytogrepfor/genh.py:5 
f = open(sys.argv[1], 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7eda270661707f4c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/98 install all targets/script.py:6 
  with open(f, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ad59ab5c01a087b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/98 install all targets/subdir/script.py:6 
  with open(f, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29a7165cf55e8355 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/vala/10 mixed sources/c/writec.py:11 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a612ffd746fac99 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/vala/8 generated sources/src/write_wrapper.py:11 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1e21fad75e64460 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/10 vs module defs generated custom target/subdir/make_def.py:4 
with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3db3baf0f75db4ad — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/12 resources with custom targets/res/gen-res.py:5 
with open(sys.argv[1]) as infile, open(sys.argv[2], 'w') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a443f6cd7b36ef43 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/14 resources with custom target depend_files/ico/gen-ico.py:5 
with open(sys.argv[1], 'rb') as infile, open(sys.argv[2], 'wb') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9acdf8e06e6e139f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/16 gui app/gui_app_tester.py:8 
    if 'CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #55d3ca9d8aacb0d5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/ac_converter.py:362 
with open(sys.argv[1], encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1d925ba0884705fb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:69 
    raw = jamroot.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b30e5d50f321c437 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:82 
    raw = jamfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #11aff9418959c5a5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:176 
    data = json.loads(meta_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4aaf16c6f465d59d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/tools/build_website.py:30 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #75c1782ab6abd72b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/dircondenser.py:46 
    with open(sourcefile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f013035b52b73bcb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/dircondenser.py:50 
    with open(sourcefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1584c8dab6e92ff5 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:23 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2853055439644dde — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:121 
            with open(output_dir / (cmd+'_'+typ+'.inc'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #3b036dc9595b2934 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:125 
    url = urlopen('https://wrapdb.mesonbuild.com/v2/releases.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #004adb1156675acd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:127 
    with open(output_dir / 'wrapdb-table.md', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #deeea31070d9ecaf — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:160 
        with open(output_dir/dummy_output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b52c1caa759f6302 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:12 
        if v in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f294ee8c7c87da5e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:13 
            del os.environ[v]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9ef59a76618054b — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:16 
    os.environ.setdefault('MESON_UNIT_TEST_BACKEND', 'ninja')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55243addfe54742c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:136 
                with open(fin, 'wb') as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #967f39b85393f6f8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:140 
                    with open(fout, 'rb') as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc0f783e2eb36e75 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:258 
                with open(os.path.join(self.builddir, header), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12d49d311a51abd6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:262 
                with open(os.path.join(cmake_builddir, header), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab6b1b7763ee3de0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:541 
        text_log = Path(self.logdir, 'testlog.txt').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9fa835c0970ea36 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:543 
        json_log = json.loads(Path(self.logdir, 'testlog.json').read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e20d6fb73a59ef5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:741 
        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9999e7fba6325f6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:760 
        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ea99141f3d3506e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:800 
        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e08c0b3a26fcf56 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:805 
        with open(os.path.join(self.logdir, 'testlog-valgrind.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2931dc52d8a2f5a5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:825 
        with open(os.path.join(self.logdir, 'testlog-good.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bab9664d8447bb42 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:830 
        with open(os.path.join(self.logdir, 'testlog-good.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b2b50447d831b5c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:866 
        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a33f0683292b7ad7 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:871 
        with open(os.path.join(self.logdir, 'testlog-mydefault.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef80b420364262eb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:876 
        with open(os.path.join(self.logdir, 'testlog-other.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44eeb327241999a2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:897 
            with open(os.path.join(self.logdir, 'testlog.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74c0eed06f8858c7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1057 
        if mesonbuild.envconfig.detect_msys2_arch() and ('MESON_RSP_THRESHOLD' in os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e993273aa7ccaae — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1122 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #656348513ff6ccb2 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1143 
            if evar in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d980315c7697b45 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1156 
                        evalue = os.environ.pop(evar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #059a9593b32388a7 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1237 
                    if 'arch' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b39607e71dcaafc3 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1238 
                        if os.environ['arch'] == 'x64':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d0f0876545ee26c — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1249 
                os.environ[evar] = ' '.join(quote_arg(w) for w in wrappercc)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4aff9345c955e05 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1253 
                os.environ['AR'] = ' '.join(quote_arg(w) for w in wrapperlinker)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fcc4f664af6c1b6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1268 
                del os.environ['AR']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a480d4b32e54ffd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1344 
        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3ec3f07f30cbd52 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1573 
            with open(os.path.join(project_dir, '.hg', 'hgrc'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16e6df455344dfd3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1613 
        with open(os.path.join(path, 'meson.build'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09510b4d031f94e6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1621 
            with open(os.path.join(project_dir, 'meson.build'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11c70c3035549b89 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1631 
            with open(distexe_c, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5c7682395ce3c69 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1969 
                with open(os.path.join(d, 'alexandria.pc'), 'w',
                          encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bba685607a15800e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2011 
                with open(os.path.join(d, 'alexandriaConfig.cmake'), 'w',
                        encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8717d500f0af92ba — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2140 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd4ecc626590558f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2148 
        os.environ['PKG_CONFIG_LIBDIR'] = self.privatedir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38540af88f06c1f8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2172 
            with open(os.path.join(self.privatedir, name), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92694aa3f2ceed47 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2564 
                    with open(os.path.join(tmpdir, 'foo.' + lang), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba6c14650fdb955c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2570 
                    with open(os.path.join(tmpdir, 'Foo.' + lang), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97f60ddd24107125 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2986 
        with open(os.path.join(self.builddir, 'nosubst-nocopy1.txt'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68357cf40c4a9d56 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2988 
        with open(os.path.join(self.builddir, 'nosubst-nocopy2.txt'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53e22407b5f5788a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2995 
                of = open(mfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad299e1256ceaa78 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3215 
                            with open(intro_installed_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f5cc58513b5a19f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3223 
        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39fd6e90c6f311a2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3226 
        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac5a60f9c5155f7e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3251 
        open(filename, 'w', encoding='utf-8').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5cf96cc6f405a3e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3406 
            self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d37db4b4d10f879a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3407 
                                Path(goodfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af56aadd09ed3e24 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3408 
            self.assertNotEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ae24d67840328f9 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3409 
                                Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0739fde03b1a9033 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3413 
            self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d0418c43a72b7fc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3414 
                                Path(goodfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f92dccb6a57db336 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3415 
            self.assertNotEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72229bf9b18bc63b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3416 
                                Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a51ea28e40843f14 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3419 
            with open(includefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10fa7e5f2017a297 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3422 
            self.assertEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55925fccd7401a41 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3423 
                             Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e802444ed4ba3002 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3465 
        self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d0035b43ccf5771 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3466 
                            Path(fixedfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #548fe22cce53bcd5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3471 
        self.assertEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad080ae0465b682a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3472 
                         Path(fixedfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2261904ee243171a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3523 
        with open(os.path.join(infodir, 'intro-targets.json'), encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4378b778a4d5faa — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3657 
            with open(curr, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1da1c4b32d44ceea — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3795 
            with open(curr, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96c06dade19972dc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3805 
        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5fb455ad414bb80 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3820 
        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5099d1d7a78bd4e1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3838 
        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68f8182ac5f20ab6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3849 
        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae2a5385eb369de2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4279 
        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ba437b7c674e9db — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4296 
        with open(doc_path, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7095145b16dd2988 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4499 
            with open(os.path.join(srcdir, 'subprojects', 'wrap_git.wrap'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #938a079d4c1df9a7 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4516 
            with open(os.path.join(srcdir, 'subprojects', 'wrap_git.wrap'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b93e370cdf9a6b4 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4553 
        with open(machinefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a80df8fe631dc7a5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4582 
        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #beae79981317d2c0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4591 
        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1294eb5a323411b8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4600 
        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ba1bf3fd6b8136b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4609 
        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db0daac637782b86 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4614 
        with open(real_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee24d2b3851f75e8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4741 
        o = Path(fname).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7e82d69b939fed3 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4800 
        with mock.patch.dict(os.environ, {'CFLAGS': '-DCFLAG', 'LDFLAGS': '-flto'}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb2833b9079184d1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4991 
        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33872dd2d32cd054 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5324 
        with open(gen_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2edc49bb2e7c4faf — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5332 
        with open(gen_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0af621016b2205e2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5409 
        olddata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3278f2c54b0ffc3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5414 
            newdata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24694a189b302b33 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5423 
            newdata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56abc75d9b71abe3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5585 
        with open(os.path.join(testdir, 'mod1.f90'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #755318f3cd97e763 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5595 
        with open(os.path.join(testdir, 'test.f90'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d61c0ef1bf531792 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:72 
        cls.backend_name = os.environ.get('MESON_UNIT_TEST_BACKEND', 'ninja')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0f90e913b83091f — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:107 
        cls.env_patch = mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d6434f8a9d4fe44 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:110 
        os.environ['COLUMNS'] = '80'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f325db85b8d2d4e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:111 
        os.environ['PYTHONIOENCODING'] = 'utf8'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #642eb2760000c960 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:120 
        if (is_windows() or is_cygwin()) and not os.environ.get('MESON_FORCE_UNITTEST_IN_TMP', '0') == '1':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffea06ebba05b349 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:160 
        return open(log, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bc70b3910ee6467 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:186 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3329e96c2d422fa — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:290 
            with mock.patch.dict(os.environ, override_envvars):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc8869c7d9fcdd2f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:341 
            with open(os.path.join(self.builddir, 'compile_commands.json'), encoding='utf-8') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #217ab4636e983941 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:355 
                with open(rsp, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d49756a0c133171 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:188 
            with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de83e51d86aa2df5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:328 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b40ab36d9c69cb6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:346 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b6acf8e55b35869 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:360 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd5906c9005a1d3e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:397 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bd2baeea6cf2e79 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:414 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9fe41f544cf129a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:438 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5fc83a7fb22b215 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:454 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb464dcacbaf774e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:494 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdc17a24f1b1b7fb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:512 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66bd2902620e4365 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:546 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ab81351583447e0 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:566 
            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4feeb1c919192b1 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/darwintests.py:59 
        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6153e481a55d7f8a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/darwintests.py:70 
        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b8a50f54ee26ed3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:71 
        with open('docs/markdown/Builtin-options.md', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d225b32d31e59bfa — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:105 
        with open('docs/markdown/Builtin-options.md', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b58858cc01c5a604 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:176 
        with open("docs/markdown/Reference-tables.md", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba34e46d67ea035f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:192 
        with open("docs/sitemap.txt", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d9c18e46711218b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:206 
        with open("docs/theme/extra/templates/navbar_links.html", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62125f21ee91265e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:218 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #636c510548ad7dd1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:228 
        del os.environ['MESON_RUNNING_IN_PROJECT_TESTS']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f554f46ccf615e8e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:231 
        with open('data/syntax-highlighting/vim/syntax/meson.vim', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8fc32ab1fe2c9ca — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:236 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07f639d2d1c175f4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:246 
        del os.environ['MESON_RUNNING_IN_PROJECT_TESTS']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #510762df9289434c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:93 
        with open(self.mbuild, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #077aa4607b14106f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:102 
            with open(self.moptions, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05a5f0bdd238beed — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:119 
        with open(self.mbuild, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbafb21e5b08a18e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/featurestests.py:85 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d68c63fc33080cc1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/featurestests.py:96 
        os.environ.pop('MESON_RUNNING_IN_PROJECT_TESTS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08a5b7e61433c999 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:34 
IS_CI = os.environ.get('MESON_CI_JOBNAME', 'thirdparty') != 'thirdparty'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb06292f65106bd5 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:211 
            if not IS_CI and key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fae423ad3271191 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:213 
            with mock.patch.dict(os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed927acb957be431 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:214 
                os.environ.pop(key, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #459c2e40240b21f4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:301 
    if os.environ.get('MESON_CI_JOBNAME') == name:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a46e30c46777c863 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:727 
            script_path.write_text('import sys\nprint(sys.argv[1])\n', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #219b1579d04eb9cb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:1081 
        with open('data/test.schema.json', 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bf7c07a201fd82c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:1092 
                schema_validator(json.loads(p.read_text(encoding='utf-8')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc7028d117ff1127 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:42 
PKG_CONFIG = os.environ.get('PKG_CONFIG', 'pkg-config')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ede9d88d4629c85 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:58 
    pkgconf = os.environ.get('PKG_CONFIG_PATH')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28cb9432025f1052 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:156 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2bd8d39a9f57af4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:168 
        os.environ['PKG_CONFIG_LIBDIR'] = self.privatedir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5ce45c2ce7cdee5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:224 
        with open(os.path.join(privatedir2, 'dependency-test.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a65291b44080c0f5 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:255 
        with open(os.path.join(privatedir1, 'simple2.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fb91ca280115ffc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:260 
        with open(os.path.join(privatedir1, 'simple3.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eedae48d169d8813 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:264 
        with open(os.path.join(privatedir1, 'simple5.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e3fde051ed0f4d0 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:268 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e0ec132aa3d38ba — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:274 
        os.environ['PKG_CONFIG_LIBDIR'] = os.path.join(self.builddir, 'meson-uninstalled')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5db199b80ec5415 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:276 
            os.environ['PATH'] += os.pathsep + self.builddir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1e3ba4e4ab45beb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:287 
        with open(os.path.join(self.privatedir, 'somename.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06757746184ba2e9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:824 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5652890f19e2d98b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:849 
        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ef622253bebff49 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1132 
            myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e4dcb4f35fc63bf — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1143 
            myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93a26d66ef612715 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1272 
        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20d6f0ab863a263d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1287 
        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbad749d1005f0f9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1300 
        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f60476521358297 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1312 
        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad339533e091e047 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1331 
        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d56782bc7435dbd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1344 
        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48af62ab5a61e083 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1430 
        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b27b38bfdfa3a5d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1495 
                os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2746abc93e8af180 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1545 
        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd571440e2157ffb — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1554 
        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0232b21df9de9096 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1653 
            with mock.patch.dict(os.environ, {envvar: name}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76df3dde1d1850dc — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1704 
        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db8ad52c2f824afe — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1728 
        with open(wrap_filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0b504894aa3258e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1756 
            with open(os.path.join(d, 'meson.build'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd810805f1fbaafd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1767 
        with open(os.path.join(self.privatedir, 'bar1.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a34a7a0e242b5e8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1770 
        with open(os.path.join(self.privatedir, 'bar2.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3e06276c0228c18 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1888 
        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49afde4808b22fe9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:80 
                home = PurePath(os.environ['HOME'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f8e3bdda7e363dd — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:84 
                if 'USER' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdc21806d6ff4140 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:86 
                home = PurePath('C:\\', 'Users', os.environ['USER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df07918941d445c7 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:112 
        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d70f2ab252cfdf46 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:134 
        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #905c4213f9a05bbf — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:172 
        with open(batfile, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8497e0183b3efae — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:206 
                with open(fifo, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #757516d6953e4aef — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:793 
    @skipIf('MESON_EXE' in os.environ, 'MESON_EXE is defined, cannot use mocking.')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ded8c6ca1460178a — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:808 
                with mock.patch.dict(os.environ, {'XDG_DATA_HOME': d}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd8139ee4caa75c6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:813 
                with mock.patch.dict(os.environ, {'XDG_DATA_DIRS': d}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5836b3df3795a92d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:814 
                    os.environ.pop('XDG_DATA_HOME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94cc1b3397e0b542 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:829 
                with mock.patch.dict(os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dca75cf2eb16bfb6 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:830 
                    os.environ.pop('XDG_DATA_HOME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #878d32dc7716ef48 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:843 
        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41db2eb0a92ce959 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:943 
                    del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16c1ebe86a8ccdc8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:104 
                with open(os.path.join(self.builddir, 'meson-info', 'intro-targets.json'), 'r', encoding='utf-8') as tgt_intro:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c5702ab73ca37256 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:141 
            with urllib.request.urlopen('https://wrapdb.mesonbuild.com') as p:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #59dce1bb651c661d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:174 
        with open(os.path.join(testdir, 'test.json'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0606abf2d62249e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:295 
        with open(os.path.join(self.builddir, 'meson-logs', 'profile-startup-modules.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c179bf4c18c677cd — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:298 
        with open(os.path.join(testdir, 'expected_mods.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13f892944c40f911 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:387 
        with open(editorconfig, 'w', encoding='utf-8') as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25ffe326ebbd3b70 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:453 
        with open(os.path.join(testdir, 'meson_options.txt'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f37aa24eb100a443 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:462 
        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5da1dd5c34e6e03b — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:464 
        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c0554e58e8fb5f6 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:487 
        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d8339aeca49d95d — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:489 
        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f533e7b631608a4a — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:502 
        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b08acee9b8ef686 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:504 
        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79b4f65d5a3de32c — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:527 
        with open(os.path.join(testdir, 'meson.options'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #597347093b388b34 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:536 
        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcb56026c327a0f2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:545 
        with open(os.path.join(testdir, 'subprojects/subproject/meson_options.txt'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8df9bb57e8ccddaf — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:600 
            Path(d, 'bar.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07c842977f8afe72 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:605 
            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #528138cb84798ffa — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:612 
            Path(d, 'bar.c').write_text('int bar() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b850cc799198c8d8 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:613 
            Path(d, 'foo.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #febda178a4e26461 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:617 
            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0146dedbe9fcb91e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:624 
            Path(d, 'bar.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1793a47d462f8e40 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:629 
            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa955840a90b9d22 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:640 
            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c18878dd0b20237 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/pythontests.py:45 
            mesonfile.write_text('''project('test', 'c', version: '1')
pymod = import('python')
python = pymod.find_installation('python3', required: true)
''', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #698eecbeb4de241f — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/rewritetests.py:485 
        original_contents = meson_build_file.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e4a68b7350ed123 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/rewritetests.py:531 
        expected = Path(test_path / "expected_dag.txt").read_text(encoding='utf-8').strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5f6e71d03268631 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:35 
        with open(str(path / 'meson.build'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4584e5bb55462715 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:97 
        with open(str((self.subprojects_dir / name).with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ca3bc674021a2a3 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:112 
        with open(str((self.subprojects_dir / name).with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34401b3cf482a4e2 — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:260 
        with open(str((self.subprojects_dir / 'redirect').with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa949cd9781d6f91 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:49 
    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b1b5abb23a10513 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:78 
        os.environ['PATH'] += os.pathsep + testdir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #377b0f8932972a2e — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:80 
        if '.PY' in [ext.upper() for ext in os.environ['PATHEXT'].split(';')]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2e8e1c03e8a03c4 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:104 
        path = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #512e971466e33623 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:106 
            username = os.environ['USERNAME']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #598155257e5be34d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:240 
            current_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45875a77c09f7609 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:296 
            with mock.patch.dict(os.environ, {envvar: name}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f541ec51ac2ecd2e — Filesystem access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:382 
        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba9565cca0fe06e1 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:441 
        if 'VSCMD_VER' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e186bf86a1569e9 — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:443 
        if version_compare(os.environ['VSCMD_VER'], '<16.10.0'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ca1216feadf552d — Environment-variable access.
pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:466 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ollama

python dependency
expand_more 8 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #99171bab5915db29 — Filesystem access.
pkgs/python/[email protected]/examples/generate-image.py:13 
    with open('output.png', 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #99b9156269f755ee — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/multimodal-generate.py:8 
latest = httpx.get('https://xkcd.com/info.0.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #1d70d5f243db4d42 — Environment-variable access.
pkgs/python/[email protected]/ollama/_client.py:108 
    api_key = os.getenv('OLLAMA_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3da2d4dc324c46b2 — Environment-variable access.
pkgs/python/[email protected]/ollama/_client.py:113 
      base_url=_parse_host(host or os.getenv('OLLAMA_HOST')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d23cda685de7d0a2 — Filesystem access.
pkgs/python/[email protected]/ollama/_client.py:611 
    with open(path, 'rb') as r:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8dd21b7054dbb7e — Filesystem access.
pkgs/python/[email protected]/ollama/_client.py:620 
    with open(path, 'rb') as r:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #486fb66a5553095a — Filesystem access.
pkgs/python/[email protected]/ollama/_types.py:167 
      return b64encode(self.value.read_bytes() if isinstance(self.value, Path) else self.value).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88842e43c30baffb — Filesystem access.
pkgs/python/[email protected]/ollama/_types.py:172 
          return b64encode(Path(self.value).read_bytes()).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openpyxl

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #1e805de1de5fe53f — Filesystem access.
pkgs/python/[email protected]/openpyxl/worksheet/_writer.py:379 
        with open(self.out, "rb") as src:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98218961d8d7a7df — Environment-variable access.
pkgs/python/[email protected]/openpyxl/xml/__init__.py:23 
    return os.environ.get("OPENPYXL_LXML", "True") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #070f91c10795d24e — Environment-variable access.
pkgs/python/[email protected]/openpyxl/xml/__init__.py:39 
    return os.environ.get("OPENPYXL_DEFUSEDXML", "True") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3afee334fc65a2a4 — Filesystem access.
pkgs/python/[email protected]/setup.py:24 
    with open(os.path.join(here, 'README.rst')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

opensearch-py

python dependency
expand_more 11 low-confidence finding(s)
low env_fs dependency Excluded from app score #c88e8cb94031eec0 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/_async/helpers/test.py:17 
OPENSEARCH_URL = os.environ.get("OPENSEARCH_URL", "https://localhost:9200")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7260b93414855fd4 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/connection/base.py:100 
        if os.getenv("ELASTIC_CLIENT_APIVERSIONING") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2e46315767dff49 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/connection/base.py:329 
        ca_certs = os.environ.get("SSL_CERT_FILE") or os.environ.get("SSL_CERT_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4775dc6881d5f101 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:37 
OPENSEARCH_URL = os.environ.get("OPENSEARCH_URL", "https://localhost:9200")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee5a8276f0e6883d — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:44 
    if "PYTHON_CONNECTION_CLASS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fcc82c923e4206e1 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:48 
            connection, os.environ["PYTHON_CONNECTION_CLASS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9173c2b70245e765 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:107 
if "OPENSEARCH_VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f022443294815882 — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:108 
    OPENSEARCH_VERSION = _get_version(os.environ["OPENSEARCH_VERSION"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0908839279f70ba — Environment-variable access.
pkgs/python/[email protected]/opensearchpy/helpers/test.py:113 
            http_auth=("admin", os.getenv("OPENSEARCH_PASSWORD", "admin")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99940936ebf480ad — Filesystem access.
pkgs/python/[email protected]/setup.py:37 
with open(
    join(BASE_DIR, PACKAGE_NAME.replace("-", ""), "_version.py"), encoding="utf-8"
) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39677edf2885f694 — Filesystem access.
pkgs/python/[email protected]/setup.py:47 
with open(join(BASE_DIR, "README.md"), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

packaging

python dependency
expand_more 3 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #66fdd75d672fea55 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:11 
with open(os.path.join(_BASE_DIR, "src", "packaging", "__init__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac2d35f24b3cfcfd — Filesystem access.
pkgs/python/[email protected]/src/packaging/_manylinux.py:34 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c083028b162e586e — Filesystem access.
pkgs/python/[email protected]/src/packaging/_musllinux.py:46 
        with open(executable, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pandas

python dependency
expand_more 28 low-confidence finding(s)
low env_fs dependency Excluded from app score #c65a904028b3f9f4 — Filesystem access.
pkgs/python/[email protected]/generate_pxi.py:8 
    with open(pxifile, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a57d0e85d4a6a0df — Filesystem access.
pkgs/python/[email protected]/generate_pxi.py:12 
    with open(outfile, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #477eacc07d7a4614 — Environment-variable access.
pkgs/python/[email protected]/generate_version.py:25 
    if os.environ.get("MESON_DIST_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35cd3377b2cb73fe — Environment-variable access.
pkgs/python/[email protected]/generate_version.py:26 
        path = os.path.join(os.environ.get("MESON_DIST_ROOT"), path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67ad4f93d3b46f8a — Filesystem access.
pkgs/python/[email protected]/generate_version.py:27 
    with open(path, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a806fd973ac8a00 — Environment-variable access.
pkgs/python/[email protected]/pandas/_testing/contexts.py:76 
                    del os.environ["TZ"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #996b6a113281b40e — Environment-variable access.
pkgs/python/[email protected]/pandas/_testing/contexts.py:80 
                os.environ["TZ"] = tz

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #437fca3791a7d838 — Environment-variable access.
pkgs/python/[email protected]/pandas/_testing/contexts.py:85 
    orig_tz = os.environ.get("TZ")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcb1a30dc47e88fc — Filesystem access.
pkgs/python/[email protected]/pandas/_version.py:159 
        with open(versionfile_abs, encoding="utf-8") as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c599f2797237d356 — Environment-variable access.
pkgs/python/[email protected]/pandas/_version.py:264 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1e4dd141b4f6356 — Environment-variable access.
pkgs/python/[email protected]/pandas/compat/__init__.py:154 
    return os.environ.get("PANDAS_CI", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ea3f01ae18a1589 — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:425 
        if os.environ.get("PANDAS_COPY_ON_WRITE", "0") == "warn"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad8c74470bca35eb — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:426 
        else os.environ.get("PANDAS_COPY_ON_WRITE", "1") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #968ac0ed9b681fd8 — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:878 
        False if os.environ.get("PANDAS_FUTURE_INFER_STRING", "1") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2cf70e363179a74 — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:895 
        os.environ.get("PANDAS_FUTURE_DISTINGUISH_NAN_AND_NA", "0") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc70535e50ae410d — Environment-variable access.
pkgs/python/[email protected]/pandas/core/config_init.py:906 
        False if os.environ.get("PANDAS_FUTURE_PYTHON_SCALARS", "0") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ebf208eccaaa6fe — Filesystem access.
pkgs/python/[email protected]/pandas/core/series.py:1573 
            with open(buf, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c7e99dc293941be — Environment-variable access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:74 
HAS_DISPLAY = os.getenv("DISPLAY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ede90fa5fc0069d4 — Filesystem access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:302 
        with open("/dev/clipboard", "w", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d71d4966d563a854 — Filesystem access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:306 
        with open("/dev/clipboard", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32b553b04646a316 — Environment-variable access.
pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:569 
        if os.environ.get("WAYLAND_DISPLAY") and _executable_exists("wl-copy"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6963008e7460731 — Filesystem access.
pkgs/python/[email protected]/pandas/io/common.py:930 
            handle = open(
                handle,
                ioargs.mode,
                encoding=ioargs.encoding,
                errors=errors,
                newline="",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #852748502912e519 — Filesystem access.
pkgs/python/[email protected]/pandas/io/common.py:939 
            handle = open(handle, ioargs.mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3ef581c8e0f53aa — Filesystem access.
pkgs/python/[email protected]/pandas/io/common.py:1192 
        handle = open(handle, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d81cc4b1a7e1147 — Filesystem access.
pkgs/python/[email protected]/pandas/io/formats/format.py:1076 
        with open(buf, "w", encoding=encoding, newline="") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4df591e799da7a3 — Environment-variable access.
pkgs/python/[email protected]/pandas/util/_print_versions.py:57 
        "LC_ALL": os.environ.get("LC_ALL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b1edf849a9eb5e1 — Environment-variable access.
pkgs/python/[email protected]/pandas/util/_print_versions.py:58 
        "LANG": os.environ.get("LANG"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb03d15d94a28c16 — Filesystem access.
pkgs/python/[email protected]/pandas/util/_print_versions.py:148 
            with open(as_json, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pipmaster

python dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #69920cc3e41f4f6b — Filesystem access.
pkgs/python/[email protected]/pipmaster/async_package_manager.py:273 
            with open(requirements_file, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #102c62871eedfa7d — Environment-variable access.
pkgs/python/[email protected]/pipmaster/core.py:112 
            clean_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd5c83b20d19ec30 — Filesystem access.
pkgs/python/[email protected]/pipmaster/core.py:513 
            with open(requirements_file, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pre-commit

python dependency
expand_more 57 low-confidence finding(s)
low env_fs dependency Excluded from app score #2937db82a9eb176e — Environment-variable access.
pkgs/python/[email protected]/pre_commit/color.py:98 
            os.getenv('TERM') != 'dumb'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #399d3756751d9b80 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/color.py:105 
        '--color', default=os.environ.get('PRE_COMMIT_COLOR', 'auto'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e3ca09497d9ec47 — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/autoupdate.py:125 
    with open(path, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc9bd70100c2908e — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/autoupdate.py:135 
        with open(path, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7ce3dc548266946 — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/autoupdate.py:158 
    with open(path, 'w', newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de4c702cff33cf7a — Environment-variable access.
pkgs/python/[email protected]/pre_commit/commands/hook_impl.py:22 
    if os.environ.get('PRE_COMMIT_RUNNING_LEGACY'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e085d8371565753 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/commands/hook_impl.py:55 
        if skip_on_missing_config or os.getenv('PRE_COMMIT_ALLOW_NO_CONFIG'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad82bbc092a81c0f — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/install_uninstall.py:59 
    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce9158622d94e480 — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/install_uninstall.py:92 
    with open(hook_path, 'w') as hook_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db36d394ed57f84a — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/migrate_config.py:115 
    with open(config_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f17f21741b331e6 — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/migrate_config.py:129 
        with open(config_file, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #063875498da3d144 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/commands/run.py:342 
        environ: MutableMapping[str, str] = os.environ,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a694f95e70dd6ec9 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/commands/try_repo.py:37 
        env = dict(os.environ, GIT_INDEX_FILE=idx, GIT_OBJECT_DIRECTORY=objs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06d4022b0e5e530d — Filesystem access.
pkgs/python/[email protected]/pre_commit/commands/try_repo.py:68 
        with open(config_filename, 'w') as cfg:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f0f5cbac560f275 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/envcontext.py:47 
    env = os.environ if _env is None else _env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #712c140457b097cb — Filesystem access.
pkgs/python/[email protected]/pre_commit/error_handler.py:36 
            log: IO[bytes] = ctx.enter_context(open(log_path, 'wb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f862123c70ae8b27 — Filesystem access.
pkgs/python/[email protected]/pre_commit/file_lock.py:73 
    with open(path, 'a+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23e1706b5607c6ab — Environment-variable access.
pkgs/python/[email protected]/pre_commit/git.py:36 
    _env = _env if _env is not None else os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e77fd494fa0970d — Filesystem access.
pkgs/python/[email protected]/pre_commit/git.py:118 
    with open(os.path.join(get_git_dir('.'), 'MERGE_MSG'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36f85e58f9338678 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/lang_base.py:136 
    if 'PRE_COMMIT_NO_CONCURRENCY' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc4499e09d25d7cb — Environment-variable access.
pkgs/python/[email protected]/pre_commit/lang_base.py:140 
        if 'TRAVIS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e10dab685454d9e5 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/conda.py:51 
    if os.environ.get('PRE_COMMIT_USE_MICROMAMBA'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b07d012354ddb60a — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/conda.py:53 
    elif os.environ.get('PRE_COMMIT_USE_MAMBA'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6755122e8b5659c4 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/dart.py:49 
        dart_env = {**os.environ, 'PUB_CACHE': pub_cache}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d04daee7dab38fac — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/dart.py:51 
        with open(prefix_p.path('pubspec.yaml')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ed69fa185a595ca — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/dart.py:83 
                env={**os.environ, 'PUB_CACHE': dep_tmp},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81e67c1d5d6310f1 — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/docker.py:36 
        with open('/proc/1/mountinfo', 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #139383f8e047c2b5 — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/dotnet.py:43 
        with open(nuget_config, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #f3434d1a08981361 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/pre_commit/languages/golang.py:92 
    resp = urllib.request.urlopen('https://go.dev/dl/?mode=json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #d585271f7b3d99ba — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/golang.py:145 
    env = no_git_env(dict(os.environ, GOPATH=gopath))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa4b23a4a03e102c — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/golang.py:151 
            os.path.join(env_dir, '.go', 'bin'), os.environ['PATH'],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #121ff7eda7db20d5 — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/julia.py:91 
            open(os.path.join(envdir, 'Project.toml'), 'a').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab657e043e2aa9f8 — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/pygrep.py:24 
    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #018b114c2fc5ce7a — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/pygrep.py:35 
    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc4429b26f8f7507 — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/pygrep.py:54 
    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02ce9221c288ce52 — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/pygrep.py:67 
    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a0a543245076150 — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/python.py:38 
    with open(filename, encoding='UTF-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #494371716f953c7e — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/python.py:70 
        env = dict(os.environ, PYTHONIOENCODING='UTF-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab3e9a912e82fa6c — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/r.py:118 
        with open(fname, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4905619b27619d7 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/languages/r.py:150 
    r_home = os.environ.get('R_HOME')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #426cf82861f10e4f — Filesystem access.
pkgs/python/[email protected]/pre_commit/languages/rust.py:97 
                with open(rustup_init, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9ed2381ea981c7f — Environment-variable access.
pkgs/python/[email protected]/pre_commit/main.py:39 
os.environ.pop('__PYVENV_LAUNCHER__', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3a07bc2e49bc04e — Environment-variable access.
pkgs/python/[email protected]/pre_commit/main.py:42 
os.environ.pop('PYTHONEXECUTABLE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #350d43793b3d0cc2 — Filesystem access.
pkgs/python/[email protected]/pre_commit/output.py:22 
            stream = exit_stack.enter_context(open(logfile_name, 'ab'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a7913639a778e6c — Environment-variable access.
pkgs/python/[email protected]/pre_commit/parse_shebang.py:29 
    environ = env if env is not None else os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdc519cc1f2c16ae — Filesystem access.
pkgs/python/[email protected]/pre_commit/repository.py:42 
        with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2b82dbaf50c4640 — Filesystem access.
pkgs/python/[email protected]/pre_commit/repository.py:101 
        with open(staging, 'w') as state_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50d4588afa532aaf — Filesystem access.
pkgs/python/[email protected]/pre_commit/repository.py:106 
        open(_state_filename_v2(venv), 'a+').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f9266e09528b4d7 — Filesystem access.
pkgs/python/[email protected]/pre_commit/staged_files_only.py:74 
        with open(patch_filename, 'wb') as patch_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b6c4f3fb2d4d4ac — Environment-variable access.
pkgs/python/[email protected]/pre_commit/staged_files_only.py:78 
        no_checkout_env = dict(os.environ, _PRE_COMMIT_SKIP_POST_CHECKOUT='1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b33324fc75fd7940 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/store.py:32 
    ret = os.environ.get('PRE_COMMIT_HOME') or os.path.join(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25e875bad28f4140 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/store.py:33 
        os.environ.get('XDG_CACHE_HOME') or os.path.expanduser('~/.cache'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3dbf63b7a4465aff — Filesystem access.
pkgs/python/[email protected]/pre_commit/store.py:55 
        with open(target_file, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #612b8c5fb60ac974 — Filesystem access.
pkgs/python/[email protected]/pre_commit/store.py:72 
            with open(os.path.join(self.directory, 'README'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ecb152a97b1e1fa3 — Filesystem access.
pkgs/python/[email protected]/pre_commit/util.py:40 
    return files.joinpath(filename).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a43bf76bfcb832de — Filesystem access.
pkgs/python/[email protected]/pre_commit/util.py:176 
        with open(os.devnull) as devnull, Pty() as pty:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9ca06d44e3d5992 — Environment-variable access.
pkgs/python/[email protected]/pre_commit/xargs.py:42 
    environ = _env if _env is not None else getattr(os, 'environb', os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

psutil

python dependency
expand_more 27 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #82e763a9f904e483 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:39 
    with open(INIT) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f2feb5416f47144 — Environment-variable access.
pkgs/python/[email protected]/psutil/_common.py:34 
PSUTIL_DEBUG = bool(os.getenv('PSUTIL_DEBUG'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb36522376831ba9 — Filesystem access.
pkgs/python/[email protected]/psutil/_common.py:682 
    return open(fname, "rb", buffering=FILE_READ_BUFFER_SIZE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31bb3e68514d02ec — Filesystem access.
pkgs/python/[email protected]/psutil/_common.py:692 
    fobj = open(  # noqa: SIM115
        fname,
        buffering=FILE_READ_BUFFER_SIZE,
        encoding=ENCODING,
        errors=ENCODING_ERRS,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5091170efa145f3b — Environment-variable access.
pkgs/python/[email protected]/psutil/_psaix.py:375 
        for path in os.environ["PATH"].split(":"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67d407de042a30dd — Filesystem access.
pkgs/python/[email protected]/psutil/_psbsd.py:142 
        with open('/proc/meminfo', 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14cad649acc0df30 — Filesystem access.
pkgs/python/[email protected]/psutil/_psbsd.py:276 
        with open('/proc/stat', 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a13078b6c40b86d — Environment-variable access.
pkgs/python/[email protected]/psutil/_pssunos.py:119 
            f"PATH=/usr/sbin:/sbin:{os.environ['PATH']}",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #38eb21a9e84edcb9 — Filesystem access.
pkgs/python/[email protected]/scripts/internal/convert_readme.py:33 
    with open(args.file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #620ca73af377576d — Filesystem access.
pkgs/python/[email protected]/scripts/internal/download_wheels.py:64 
    with open(OUTFILE, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b39564a9c67d770d — Filesystem access.
pkgs/python/[email protected]/scripts/internal/download_wheels.py:87 
        with open(os.path.expanduser(args.tokenfile)) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a26c824c99af86df — Filesystem access.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:98 
    with open(fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #dc8c4a226318cd10 — Filesystem access.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:113 
    with open(fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5011e702bd340a98 — Filesystem access.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:134 
    with open(fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4eaeb6712a286120 — Filesystem access.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:164 
    with open(fname, errors='ignore') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fc3f18b4c9702c43 — Filesystem access.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:178 
        with open(fname, errors='ignore') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b7ad4aa6ccf526fd — Filesystem access.
pkgs/python/[email protected]/scripts/internal/git_pre_commit.py:156 
    with open("MANIFEST.in", encoding="utf8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #62132ec05f1153a2 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/install_pip.py:34 
        req = urlopen(URL, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #7da53e2bcc9104cf — Filesystem access.
pkgs/python/[email protected]/scripts/internal/print_announce.py:81 
    with open(HISTORY) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fe4a5bccfbd804c9 — Environment-variable access.
pkgs/python/[email protected]/scripts/internal/print_downloads.py:42 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #247da739a140c7de — Filesystem access.
pkgs/python/[email protected]/scripts/internal/print_hashes.py:18 
    with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f77473a55ad6ce62 — Filesystem access.
pkgs/python/[email protected]/scripts/internal/purge_installation.py:56 
                with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #66ca8aab2cd69c16 — Filesystem access.
pkgs/python/[email protected]/scripts/internal/purge_installation.py:64 
                    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b73143924d47518c — Environment-variable access.
pkgs/python/[email protected]/setup.py:46 
        if "CIBUILDWHEEL" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d89d3eb1739c2aa5 — Filesystem access.
pkgs/python/[email protected]/setup.py:142 
    with open(INIT) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bba53c443ba0c39 — Environment-variable access.
pkgs/python/[email protected]/setup.py:258 
        if os.getenv('CC'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #659c10fd52348d53 — Environment-variable access.
pkgs/python/[email protected]/setup.py:259 
            compiler.set_executable('compiler_so', os.getenv('CC'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pycryptodome

python dependency
expand_more 31 low-confidence finding(s)
low env_fs dependency Excluded from app score #fc42602722a0e50f — Filesystem access.
pkgs/python/[email protected]/Doc/conf.py:81 
for line in open(os.path.join("..", "lib", "Crypto", "__init__.py")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8da0cdf320bc9c19 — Environment-variable access.
pkgs/python/[email protected]/Doc/sphinx_rtd_theme/__init__.py:61 
     context['READTHEDOCS'] = os.environ.get("READTHEDOCS", False) == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c995390d5c90fbe8 — Environment-variable access.
pkgs/python/[email protected]/Doc/sphinx_rtd_theme/__init__.py:63 
         for key, value in os.environ.items():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #962a6c5b47d3504f — Filesystem access.
pkgs/python/[email protected]/compiler_opt.py:48 
    f = open(fname, 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c368a0ca0c60c83 — Environment-variable access.
pkgs/python/[email protected]/compiler_opt.py:55 
    debug = bool(os.environ.get('PYCRYPTODOME_DEBUG', None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3c6ce69fe3c46d7 — Filesystem access.
pkgs/python/[email protected]/compiler_opt.py:62 
        dev_null = open(os.devnull, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebf6648032dc85c5 — Environment-variable access.
pkgs/python/[email protected]/lib/Crypto/Math/Numbers.py:36 
    if os.getenv("PYCRYPTODOME_DISABLE_GMP"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c681a5709b5dcad4 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1022 
        public_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34dbb05a97cd846e — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1032 
        private_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d12e5e1c72a2325 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1041 
        public_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e662a87c4fac8340 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1044 
        private_public_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bbbb1521e3f14dc — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:767 
    n, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57a424fbe4e89619 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:768 
    e, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eab7194d25177138 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:769 
    d, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef4e0ba790d48e84 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:770 
    iqmp, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7663cab73a36d475 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:771 
    p, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fe55d66e83d5248e — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:772 
    q, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e837acae41fb089 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/Hash/test_BLAKE2.py:269 
        with open(test_vector_file, "rt") as test_vector_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #619c01888ce4e652 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/Hash/test_BLAKE2.py:343 
        with open(test_vector_file, "rt") as test_vector_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fab3571b0654b0e — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/Hash/test_BLAKE2.py:402 
        with open(test_vector_file, "rt") as test_vector_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11e1bdc4e4cd7277 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/Protocol/test_HPKE.py:341 
            with open(full_file_name, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bda74945327e0d6e — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_Curve25519.py:64 
        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c22ef1ca698697d — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_Curve448.py:37 
        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdc18fcd5592dd58 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_ECC.py:70 
        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0d29cd04829ef15 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_RSA.py:56 
        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86dfa9813684ff83 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/loader.py:167 
        with open(full_file_name) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18fdcfce9017f3a1 — Filesystem access.
pkgs/python/[email protected]/lib/Crypto/SelfTest/loader.py:190 
        with open(full_file_name) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8844b675a2cb3d2 — Environment-variable access.
pkgs/python/[email protected]/lib/Crypto/Util/_raw_api.py:102 
        if hasattr(ffi, "RTLD_DEEPBIND") and not os.getenv('PYCRYPTODOME_DISABLE_DEEPBIND'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #025802ebd220ece2 — Filesystem access.
pkgs/python/[email protected]/setup.py:236 
            with open(full_file_name_dst, "rt", **extra_param) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7bc2ebe20d92934 — Filesystem access.
pkgs/python/[email protected]/setup.py:243 
            with open(full_file_name_dst, "wt", **extra_param) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79a93a751ed3833e — Filesystem access.
pkgs/python/[email protected]/setup.py:500 
with open(os.path.join("lib", package_root, "__init__.py")) as init_root:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pydantic

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #3124dd2d2fe1bdc1 — Filesystem access.
pkgs/python/[email protected]/pydantic/deprecated/parse.py:71 
    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67f994cea3659146 — Environment-variable access.
pkgs/python/[email protected]/pydantic/json_schema.py:344 
                if os.getenv('PYDANTIC_PRIVATE_ALLOW_UNHANDLED_SCHEMA_TYPES'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8efcd01c407fb2c — Filesystem access.
pkgs/python/[email protected]/pydantic/mypy.py:1411 
    with open(config_file, 'rb') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7164f79c65d27ba — Environment-variable access.
pkgs/python/[email protected]/pydantic/plugin/_loader.py:27 
    disabled_plugins = os.getenv('PYDANTIC_DISABLE_PLUGINS')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1842171be12dfa4d — Environment-variable access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:173 
            env_vars: Mapping[str, Optional[str]] = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #589235490b4f4410 — Environment-variable access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:175 
            env_vars = {k.lower(): v for k, v in os.environ.items()}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d225de01890cbd4c — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/env_settings.py:307 
                    secret_value = path.read_text().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6074d0e4425d4986 — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/mypy.py:948 
    with open(config_file, read_mode) as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #551986a810f2b330 — Filesystem access.
pkgs/python/[email protected]/pydantic/v1/parse.py:57 
    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pymongo

python dependency
expand_more 113 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #8ac4bf7303765e6f — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:292 
    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #65922f2b05bb3cba — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:321 
    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #091ceb5ba4adc69d — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:354 
    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #485ebf703e5ae993 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:64 
    base_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c749e75dd59f8c4b — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:99 
            os.environ["AZUREKMS_VMNAME_PREFIX"] = "PYTHON_DRIVER"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a3ab014deb3a53d7 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102 
            os.environ[

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2006874bd57ce513 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102 
            os.environ[
                "AZUREKMS_IMAGE"
            ] = "Canonical:0001-com-ubuntu-server-jammy:22_04-lts-gen2:latest"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #faf2d20f9e05e338 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:106 
            os.environ["GCPKMS_IMAGEFAMILY"] = "debian-12"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0e65a37607c43881 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:128 
        key_name = os.environ["KEY_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1c5e98ed4faaea27 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:129 
        key_vault_endpoint = os.environ["KEY_VAULT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e0e614345571d5c1 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:26 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #21591ac76ad6c7c7 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:64 
        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e624cb00218cd93b — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:72 
    uri1 = os.environ["TEST_URI1"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bb3015a21e50714f — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:73 
    uri2 = os.environ["TEST_URI2"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e763d970d32c5f2c — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:81 
        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2093087bfe6283ae — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:86 
    apache = os.environ["APACHE_BINARY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a99a1224915277a6 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:87 
    apache_config = os.environ["APACHE_CONFIG"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f4ea41f594b0f37e — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:34 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b8c5e7454e3264b1 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:36 
    if sub_test_name == "eks" and "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8cc2f92349caee00 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:39 
            if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f8c1f45ff8fc6d18 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:40 
                write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bb550e55d5b41aaf — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:62 
        return os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5c1c7c2b34518260 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:84 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #329dab86fa62609c — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:63 
    spec_dir = pathlib.Path(os.environ["MDB_SPECS"]) / "source"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0520f3f32dad876c — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:126 
            with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e3400043d018dbfe — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:10 
    os.environ[name] = str(value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #787a18c7635d29d4 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:22 
    if "VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5430c5f3cd0e513a — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:23 
        os.environ["MONGODB_VERSION"] = os.environ["VERSION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7221643634a2ec73 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:32 
        os.environ["TOPOLOGY"] = "replica_set"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ef5bc07bc0f447df — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:33 
        os.environ["MONGODB_VERSION"] = "7.0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c467e8ec5d43c4c9 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_server.py:35 
    if not os.environ.get("TEST_CRYPT_SHARED"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5ae6148c76932506 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:24 
AUTH = os.environ.get("AUTH", "noauth")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b7739a3ea431c5a3 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:25 
SSL = os.environ.get("SSL", "nossl")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1ec26a9f7b1b7ea3 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:26 
UV_ARGS = os.environ.get("UV_ARGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8a463e549ea8a616 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:27 
TEST_PERF = os.environ.get("TEST_PERF")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4813ae06c1cf62af — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:28 
GREEN_FRAMEWORK = os.environ.get("GREEN_FRAMEWORK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8c355aa903a3de48 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:29 
TEST_ARGS = os.environ.get("TEST_ARGS", "").split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #98598abe1678b450 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:30 
TEST_NAME = os.environ.get("TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0efce283a96d3f10 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:31 
SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #52193a58c06c13d8 — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:53 
    with open("results.json") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f71b1478ac5654fc — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:68 
    with open("report.json", "w", newline="\n") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ef73188df275a532 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:106 
    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #68094d11565483b6 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:150 
    if not os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cfe9d010c4a5807d — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:153 
    if os.environ.get("PYMONGOCRYPT_LIB"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cd1d5415a961f0d6 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:204 
    if os.environ.get("DEBUG_LOG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b61eacd2c71f8844 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:207 
    if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6336867dcc312dc4 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:57 
    value = os.environ.get(var, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7e45752c573bdedc — Filesystem access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:65 
    with open("/etc/os-release") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fbf799437e43b1ea — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:111 
        url = os.environ["LIBMONGOCRYPT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low pii_flow tooling Excluded from app score unreachable #9fb1e6d8c7f7ab75 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration. Non-production path — not application runtime.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:116 · flow /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:111 → /tmp/closeopen-kpoboabw/pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:116 
    with request.urlopen(request.Request(url), timeout=15.0) as response:  # noqa: S310

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low env_fs tooling Excluded from app score unreachable #41b861019e58ed4a — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:181 
            write_env(var, os.environ.get(var, getattr(opts, var.lower(), "")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7253176a22872a28 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:200 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #4ad10b39b92206a4 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:223 
        if "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #11beb3816a9b059b — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:225 
                if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #989023547204d382 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:226 
                    write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1a9b0e54f2bdf711 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:268 
            os.environ["KRB5_CONFIG"] = str(krb_conf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b6dc2b41c7af8703 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281 
        SINGLE_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2ad26974113b3ab2 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281 
        SINGLE_MONGOS_LB_URI = os.environ.get(
            "SINGLE_MONGOS_LB_URI", "mongodb://127.0.0.1:8000/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1addb9d3455eeeb4 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284 
        MULTI_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c89eaad54ddd2f0d — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284 
        MULTI_MONGOS_LB_URI = os.environ.get(
            "MULTI_MONGOS_LB_URI", "mongodb://127.0.0.1:8001/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8e6e06c3bb49c34e — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:304 
            os.environ["OCSP_SERVER_TYPE"] = sub_test_name

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #47af1fe146291806 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:306 
            if name not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #08af439589898414 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:309 
        server_type = os.environ["OCSP_SERVER_TYPE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #162789c2dec4a4d6 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:310 
        orch_file = os.environ["ORCHESTRATION_FILE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #88813b706d963c74 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:321 
            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0d3cbe56af9a9cf6 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:328 
        version = os.environ.get("VERSION", "latest")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a50f10fe40ed03b3 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:349 
    compressors = os.environ.get("COMPRESSORS") or opts.compressor

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #617dd8f23542a6ed — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:412 
        if "AWS_ROLE_SESSION_NAME" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #eab8445a6332666d — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:472 
        framework = opts.green_framework or os.environ["GREEN_FRAMEWORK"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b5a34304d445f93a — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:10 
TEST_NAME = os.environ.get("TEST_NAME", "unconfigured")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d0647cbe16d6d50f — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:11 
SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e0ec63084b8b617c — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:52 
    Path(os.environ["OUTPUT_FILE"]).unlink(missing_ok=True)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1d4b8a262ee9bd3b — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:61 
if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8ef8aadedbc1ff8f — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:15 
DRIVERS_TOOLS = os.environ.get("DRIVERS_TOOLS", "").replace(os.sep, "/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fe807d2b8c8446f6 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:169 
        if env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5d872b2e96a52a7d — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:173 
                opts.auth = os.environ.get("AUTH") == "auth"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f7087c5ceca1f265 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:175 
                ssl_opt = os.environ.get("SSL", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #f2371048bdad50d4 — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:178 
                if os.environ[env_var]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #dffbe02239ec8fbd — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:181 
                setattr(opts, key, os.environ[env_var])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8f7a7404ea94f3ba — Environment-variable access.
pkgs/python/[email protected]/.evergreen/scripts/utils.py:211 
    env = kwargs.pop("env", os.environ).copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95cdf9b2348d7326 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:71 
            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfd5344eb94c7671 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:88 
            if "ProgramFiles" in os.environ and "ProgramFiles(x86)" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ee285d3bc73153a — Environment-variable access.
pkgs/python/[email protected]/_setup.py:89 
                os.environ["ProgramFiles(x86)"] = os.environ["ProgramFiles"] + " (x86)"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a048ce609037fd8 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:94 
            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75b2015dbaf9a8e2 — Environment-variable access.
pkgs/python/[email protected]/_setup.py:127 
if "--no_ext" in sys.argv or os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fced05ddc2c5e158 — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:81 
        token_file = os.environ.get("OIDC_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fefb9e5738aa2f13 — Filesystem access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:86 
        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #991ff0aa8253af02 — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:92 
        token_file = os.environ.get("AWS_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27798a46fa0d6e97 — Filesystem access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:97 
        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65708dc7213e45c2 — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:129 
        if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4e01fd465807cf1 — Environment-variable access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:130 
            fname = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfb546c8375f3315 — Filesystem access.
pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:131 
    with open(fname) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5e08aa80cec9e07 — Filesystem access.
pkgs/python/[email protected]/pymongo/common.py:238 
    open(value).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47ec3a7e28b2ff7f — Filesystem access.
pkgs/python/[email protected]/pymongo/daemon.py:64 
            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a97a60ff6de62cb — Filesystem access.
pkgs/python/[email protected]/pymongo/daemon.py:95 
            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ab56a700c314b76 — Environment-variable access.
pkgs/python/[email protected]/pymongo/logger.py:165 
        document_length = int(os.getenv("MONGOB_LOG_MAX_DOCUMENT_LENGTH", _DEFAULT_DOCUMENT_LENGTH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91847909e9f64fde — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:78 
        "architecture": os.environ.get("PROCESSOR_ARCHITECTURE") or platform.machine(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa5b4c4db421f958 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:119 
    if os.getenv(ENV_VAR_K8S):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05cbe2d855de8fd2 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:126 
    if os.getenv("AWS_LAMBDA_RUNTIME_API"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fedc6091da8413b — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:128 
    env = os.getenv("AWS_EXECUTION_ENV")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #629ef17b784c8b17 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:135 
    return bool(os.getenv("FUNCTIONS_WORKER_RUNTIME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de9915c90dbd21a5 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:139 
    return bool(os.getenv("K_SERVICE") or os.getenv("FUNCTION_NAME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eed6caad362f3b37 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:143 
    return bool(os.getenv("VERCEL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49db3832979a9394 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:152 
    val = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1509de5ea74d633 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:171 
        region = os.getenv("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82453e20b791f92b — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:181 
        region = os.getenv("FUNCTION_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d689103624291850 — Environment-variable access.
pkgs/python/[email protected]/pymongo/pool_options.py:192 
        region = os.getenv("VERCEL_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5e74261dd08c7123 — Filesystem access.
pkgs/python/[email protected]/tools/compare_import_time.py:23 
    with open(f"pymongo-{sha}.log") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #297921598e5674eb — Filesystem access.
pkgs/python/[email protected]/tools/convert_test_to_async.py:123 
    with open(input_file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7e2bdb6c4157de94 — Filesystem access.
pkgs/python/[email protected]/tools/convert_test_to_async.py:127 
        with open(output_file, "w+") as f2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #81bf1008fa14b7d3 — Filesystem access.
pkgs/python/[email protected]/tools/ensure_future_annotations_import.py:29 
        with open(path) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6f97dfd13aa129a4 — Filesystem access.
pkgs/python/[email protected]/tools/synchro.py:290 
            with open(file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3e73e3527e6c8f38 — Environment-variable access.
pkgs/python/[email protected]/tools/synchro.py:442 
            and "OVERRIDE_SYNCHRO_CHECK" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pypdf

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #7568f0a61591e587 — Filesystem access.
pkgs/python/[email protected]/pypdf/_page.py:2033 
            debug_path.joinpath("fonts.json").write_text(
                json.dumps(fonts, indent=2, default=asdict),
                "utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7720368be1713fa0 — Filesystem access.
pkgs/python/[email protected]/pypdf/_reader.py:172 
            with open(stream, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7e34ea3e1673d50 — Filesystem access.
pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:285 
        debug_path.joinpath("bt_groups.json").write_text(
            json.dumps(ty_groups, indent=2, default=str), "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1cd10e4427301ba — Filesystem access.
pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:351 
        debug_path.joinpath("bts.json").write_text(
            json.dumps(bt_groups, indent=2, default=str), "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4dc2bf85d085ff4e — Filesystem access.
pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:354 
        debug_path.joinpath("tjs.json").write_text(
            json.dumps(
                tj_ops, indent=2, default=lambda x: getattr(x, "to_dict", str)(x)
            ),
            "utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b6af2e64174ac7d — Filesystem access.
pkgs/python/[email protected]/pypdf/_utils.py:391 
    with open("pypdf_pdfLocation.txt", "wb") as output_fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3c9bf1b890d18f0 — Filesystem access.
pkgs/python/[email protected]/pypdf/_writer.py:245 
                with open(fileobj, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1ef9e2a85a16a0e — Environment-variable access.
pkgs/python/[email protected]/pypdf/filters.py:752 
            environment = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #0903c04205841faf — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/resources/afm_to_dataclass.py:24 
        with urllib.request.urlopen(
            f"https://{FONT_LOC}"
        ) as connection, ZipFile(BytesIO(

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pypinyin

python dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #ce66596f22ae1125 — Environment-variable access.
pkgs/python/[email protected]/pypinyin/constants.py:15 
if os.environ.get('PYPINYIN_NO_PHRASES'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6984b023f839ebad — Environment-variable access.
pkgs/python/[email protected]/pypinyin/constants.py:25 
if not os.environ.get('PYPINYIN_NO_DICT_COPY'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91877e9c57904eb7 — Filesystem access.
pkgs/python/[email protected]/pypinyin/phrases_dict.py:16 
    with open(_json_path, encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2307f5105c3469d — Filesystem access.
pkgs/python/[email protected]/pypinyin/pinyin_dict.py:15 
    with open(_json_path, encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fef5fd170d358609 — Filesystem access.
pkgs/python/[email protected]/setup.py:41 
    with open(os.path.join(current_dir, 'pypinyin/__init__.py'),
              encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da3b0463dec95a78 — Filesystem access.
pkgs/python/[email protected]/setup.py:49 
    with open(os.path.join(current_dir, 'README.rst'),
              encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytest

python dependency
expand_more 433 low-confidence finding(s)
low env_fs dependency Excluded from app score #690c5ce5c326feb2 — Environment-variable access.
pkgs/python/[email protected]/doc/en/conf.py:272 
    os.getenv("READTHEDOCS", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b63338b04296f860 — Environment-variable access.
pkgs/python/[email protected]/doc/en/conf.py:273 
    and os.environ["READTHEDOCS_VERSION_TYPE"] == "tag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7de0b97509fbb94e — Filesystem access.
pkgs/python/[email protected]/doc/en/example/customdirectory/conftest.py:16 
        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e13f5a4d564d3ea9 — Filesystem access.
pkgs/python/[email protected]/doc/en/example/multipython.py:36 
        dumpfile.write_text(
            textwrap.dedent(
                rf"""
                import pickle
                f = open({str(self.picklefile)!r}, 'wb')
                s = pickle.dump({obj!r}, f, protocol=2)
                f.close()
                """
            )
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c083871f6a11df6 — Filesystem access.
pkgs/python/[email protected]/doc/en/example/multipython.py:50 
        loadfile.write_text(
            textwrap.dedent(
                rf"""
                import pickle
                f = open({str(self.picklefile)!r}, 'rb')
                obj = pickle.load(f)
                f.close()
                res = eval({expression!r})
                if not res:
                    raise SystemExit(1)
                """
            )
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee25e6d2b2611ea7 — Filesystem access.
pkgs/python/[email protected]/extra/get_issues.py:41 
        cachefile.write_text(json.dumps(issues), "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8f0c717d05b897a — Filesystem access.
pkgs/python/[email protected]/extra/get_issues.py:43 
        issues = json.loads(cachefile.read_text("utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cf2d7bb735505fee — Filesystem access.
pkgs/python/[email protected]/scripts/generate-gh-release-notes.py:24 
    changelog_lines = p.read_text(encoding="UTF-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a9a42746dc682cdf — Filesystem access.
pkgs/python/[email protected]/scripts/generate-gh-release-notes.py:61 
    Path(filename).write_text(md_body, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a3be7024049692b2 — Filesystem access.
pkgs/python/[email protected]/scripts/release.py:44 
    template_text = (
        Path(__file__).parent.joinpath(template_name).read_text(encoding="UTF-8")
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #329f568486fae555 — Filesystem access.
pkgs/python/[email protected]/scripts/release.py:54 
    target.write_text(text, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #95afa3b098722645 — Filesystem access.
pkgs/python/[email protected]/scripts/release.py:59 
    lines = index_path.read_text(encoding="UTF-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #63b7e4f4c6402d20 — Filesystem access.
pkgs/python/[email protected]/scripts/release.py:66 
                index_path.write_text("\n".join(lines) + "\n", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #894049549b8099a9 — Environment-variable access.
pkgs/python/[email protected]/scripts/release.py:84 
        env={**os.environ, "SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST": version},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68a9d99a3f989d27 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_argcomplete.py:102 
if os.environ.get("_ARGCOMPLETE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9356f7029a7fa62b — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:37 
    if os.environ.get("PY_COLORS") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d3251926597c604 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:39 
    if os.environ.get("PY_COLORS") == "0":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #288bffa77dc6deb3 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:41 
    if os.environ.get("NO_COLOR"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c9697c61ad4f83d — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:43 
    if os.environ.get("FORCE_COLOR"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76d0990bbbf03eed — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:46 
        hasattr(file, "isatty") and file.isatty() and os.environ.get("TERM") != "dumb"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c26f0ef636b7890 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:219 
        theme = os.getenv("PYTEST_THEME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c567bc97a9c11aa9 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:220 
        theme_mode = os.getenv("PYTEST_THEME_MODE", "dark")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2de98e6babe7715a — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1137 
                ignore = os.getenv("PY_IGNORE_IMPORTMISMATCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3038b42b11e7c53b — Filesystem access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1152 
                    with open(str(self), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a391cca9f04fbe8 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1208 
                    paths = os.environ["Path"].split(";")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3db6752c9008d466 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1212 
                        systemroot = os.environ["SYSTEMROOT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2d1ce403d1179c9 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1220 
                    paths = os.environ["PATH"].split(":")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75a6097becb183e1 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1223 
                tryadd += os.environ["PATHEXT"].split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b2314c3db496423 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1242 
            x = os.environ["HOME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd726bde6aec5a35 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1245 
                x = os.environ["HOMEDRIVE"] + os.environ["HOMEPATH"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b2040ed189ed49c — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1416 
            username = os.environ["USER"]  # linux, et al

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4714e19c052ea478 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/_py/path.py:1419 
                username = os.environ["USERNAME"]  # windows

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e54daa02f133e1eb — Filesystem access.
pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:293 
        with open(pathname, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4cc76897954f6f4 — Filesystem access.
pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:326 
        with open(proc_pyc, "wb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3720e158606fd6c — Filesystem access.
pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:346 
    source = fn.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d698910eee7a89ef — Filesystem access.
pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:362 
        fp = open(pyc, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad27ac3f572eac38 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/cacheprovider.py:519 
    if "TOX_ENV_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b82d6a78eb2a60aa — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/cacheprovider.py:520 
        cache_dir_default = os.path.join(os.environ["TOX_ENV_DIR"], cache_dir_default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58ecc21713834e4d — Filesystem access.
pkgs/python/[email protected]/src/_pytest/capture.py:143 
            open(os.dup(f.fileno()), mode, buffering),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23d666517819a11f — Filesystem access.
pkgs/python/[email protected]/src/_pytest/capture.py:489 
            self.tmpfile = open(os.devnull, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43e9917c9a93042f — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/compat.py:315 
    return any(os.environ.get(var) for var in env_vars)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a95d908176f35cb — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:219 
    old_pytest_version = os.environ.get("PYTEST_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95caad895c52dcb4 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:221 
        os.environ["PYTEST_VERSION"] = __version__

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc859533137ce28c — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:241 
            os.environ.pop("PYTEST_VERSION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d2a4377cb195f59 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:243 
            os.environ["PYTEST_VERSION"] = old_pytest_version

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04e96190040c1f4d — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:501 
        if os.environ.get("PYTEST_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40c93851c3f147c0 — Filesystem access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:505 
                err = open(
                    os.dup(err.fileno()),
                    mode=err.mode,
                    buffering=1,
                    encoding=encoding,
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #46a31a0466ebfb1c — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:874 
        self._import_plugin_specs(os.environ.get("PYTEST_PLUGINS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #599d92e01729bfc7 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:1336 
        ) or bool(os.environ.get("PYTEST_DISABLE_PLUGIN_AUTOLOAD"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f01d60bf69c5596f — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:1523 
            env_addopts = os.environ.get("PYTEST_ADDOPTS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18a94597d4c6aaee — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/config/__init__.py:1578 
            not os.environ.get("PYTEST_DISABLE_PLUGIN_AUTOLOAD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21be71c2eee5d028 — Filesystem access.
pkgs/python/[email protected]/src/_pytest/config/findpaths.py:102 
        toml_text = filepath.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d3aacb7de174627 — Filesystem access.
pkgs/python/[email protected]/src/_pytest/doctest.py:144 
    contents = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #016fa94abd1b0696 — Filesystem access.
pkgs/python/[email protected]/src/_pytest/doctest.py:429 
        text = self.path.read_text(encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f09130aefeb17720 — Filesystem access.
pkgs/python/[email protected]/src/_pytest/helpconfig.py:129 
        debugfile = open(path, "w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2cc887aa1cd01c58 — Filesystem access.
pkgs/python/[email protected]/src/_pytest/junitxml.py:652 
        with open(self.logfile, "w", encoding="utf-8") as logfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #318f6eef8aef4a79 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/monkeypatch.py:324 
        if prepend and name in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d0156b3688abb60 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/monkeypatch.py:325 
            value = value + prepend + os.environ[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c59de82d7f28e1e8 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/monkeypatch.py:326 
        self.setitem(os.environ, name, value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #680f5ad185138f20 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/monkeypatch.py:334 
        environ: MutableMapping[str, str] = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c44ba4d23665c22c — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/_pytest/pastebin.py:91 
            urlopen(url, data=urlencode(params).encode("ascii")).read().decode("utf-8")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #51e318c80f74cb07 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/pathlib.py:602 
    ignore = os.environ.get("PY_IGNORE_IMPORTMISMATCH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c38d93e7c820863f — Filesystem access.
pkgs/python/[email protected]/src/_pytest/pytester.py:790 
            p.write_text(source.strip(), encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdc3db89b09d65e7 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/pytester.py:1364 
        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d277373cb645275 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/runner.py:215 
        os.environ[var_name] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdea61b00f23a0ef — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/runner.py:217 
        os.environ.pop(var_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96dbf5767be7a380 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/terminalprogress.py:28 
    if reporter is not None and reporter.isatty() and os.environ.get("TERM") != "dumb":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60801d17311f51d2 — Environment-variable access.
pkgs/python/[email protected]/src/_pytest/tmpdir.py:161 
            from_env = os.environ.get("PYTEST_DEBUG_TEMPROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d9e47837668b2ed — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:378 
            s1 = initpy.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a37d7f22104b122 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:379 
            s2 = copied.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c077fefe8d2fc36c — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:392 
            s1 = otherdir.join("__init__.py").read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23aece86c9fc13e7 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:393 
            s2 = copied.join("__init__.py").read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #967121675c3c9c2e — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:464 
        stream = open(f, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2352db6c2352071e — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:478 
    samplefile.write_text("samplefile\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f15b892b182f5f8 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:481 
    execfile.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9438b351750bf6cd — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:484 
    execfilepy.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c36aa239ce581448 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:496 
    module_a.write_text("from .b import stuff as result\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0639999828f2933 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:498 
    module_b.write_text('stuff="got it"\n', encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42b320ad35cc72d3 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:500 
    module_c.write_text(
        """import py;
import otherdir.a
value = otherdir.a.result
""",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af13ab31e8b60227 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:508 
    module_d.write_text(
        """import py;
from otherdir import a
value2 = a.result
""",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26dea1edac9577c2 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:551 
        file_.write_text(f"{i}", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fcf7ed82be504c4 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:552 
        actual = int(file_.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eededd2eefbbb06c — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:714 
        assert p.read_text(encoding="utf-8") == "hello"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b257133ca7fef7e6 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:718 
        p.write_text("hello", ensure=1, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #282e0078fd7ae5a2 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:719 
        assert p.read_text(encoding="utf-8") == "hello"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6649a6de30a15c51 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:786 
        newfile.write_text("42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86c86f996d778a67 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:788 
        s = newfile.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #562c9b75cd553c48 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:822 
        l1.write_text("foo", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52331a3e3b11a5ab — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:824 
        assert l2.read_text(encoding="utf-8") == "foo"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32a7c03c878fc74d — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1300 
        filepath.write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54ea6223c09e1839 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1307 
        filepath.write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e6c039585b29cfe — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1315 
        filepath.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfb09c4aa77eef08 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1324 
        filepath.write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e1a3f8c8ed9868a — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1327 
        assert filepath.read_text(encoding="utf-8") == linkpath.read_text(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff7488f7801e1db7 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1327 
        assert filepath.read_text(encoding="utf-8") == linkpath.read_text(
            encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8f2d20645974338 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1362 
        filepath.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d34175f93607af6 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1493 
            src.join(f).write_text(f, ensure=True, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0d0323dff574210 — Environment-variable access.
pkgs/python/[email protected]/testing/_py/test_local.py:1528 
        if "LANG" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f6debb169d38e3b — Environment-variable access.
pkgs/python/[email protected]/testing/_py/test_local.py:1536 
        if "LANG" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f6547e12824b238 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1561 
        s = x.read_text(encoding="utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b5d02af819aac45 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1569 
        x.write_text(part, encoding="utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afafa173beeded48 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1571 
        assert x.read_text(encoding="utf8") == part

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3f458bc6e619503 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1577 
        x.write_text(part, "ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1de625b7b70d8c85 — Filesystem access.
pkgs/python/[email protected]/testing/_py/test_local.py:1578 
        s = x.read_text("ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3234bb04fca04fb6 — Environment-variable access.
pkgs/python/[email protected]/testing/acceptance_test.py:22 
    cur = os.getenv("PYTHONPATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #783ecaa2662eb5d2 — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:279 
        sub1.joinpath("conftest.py").write_text("assert 0", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf57f60d1ade5e85 — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:518 
        p.write_text("def test_foo(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c795a33a474d1d43 — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:663 
        path.joinpath("test_hello.py").write_text("raise ImportError", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f42c2b58303a218d — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:672 
        pkg.joinpath("test_foo.py").write_text(
            "print('hello from test_foo')\ndef test(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3cfadf666fb9870 — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:675 
        pkg.joinpath("conftest.py").write_text(
            "def pytest_configure(config): print('configuring')", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93e050eb24eddfef — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:689 
        pytester.path.joinpath("t.py").write_text("def test(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #255d9a1eb34accef — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:698 
        path.joinpath("test_hello.py").write_text(
            "def test_hello(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac6821ea46045fd0 — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:701 
        path.joinpath("test_world.py").write_text(
            "def test_world(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2da23ebf22bc41dc — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:745 
            ns.joinpath("__init__.py").write_text(
                "__import__('pkg_resources').declare_namespace(__name__)",
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b7b7f6f062f33ca — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:752 
            lib.joinpath(f"test_{dirname}.py").write_text(
                f"def test_{dirname}(): pass\ndef test_other():pass",
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba3fe25c10e3fc44 — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:839 
        lib.joinpath("test_bar.py").write_text(
            "def test_bar(): pass\ndef test_other(a_fixture):pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98b29cf1caa09089 — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:842 
        lib.joinpath("conftest.py").write_text(
            "import pytest\[email protected]\ndef a_fixture():pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0fa47a92b22e97f — Filesystem access.
pkgs/python/[email protected]/testing/acceptance_test.py:1447 
    fullXml = pytester.path.joinpath("output.xml").read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4844774b553b26eb — Filesystem access.
pkgs/python/[email protected]/testing/code/test_excinfo.py:399 
    tmp_path.joinpath("test.txt").write_text("{{ h()}}:", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #013d91867729f8bf — Filesystem access.
pkgs/python/[email protected]/testing/code/test_excinfo.py:596 
            modpath.write_text(source, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d907e2b7b0570d0 — Filesystem access.
pkgs/python/[email protected]/testing/code/test_excinfo.py:1252 
        tmp_path.joinpath("mod.py").write_text("asdf", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #087805dfdfb4a097 — Filesystem access.
pkgs/python/[email protected]/testing/code/test_source.py:298 
    path.write_text(str(source), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81a4fc715c3dc704 — Filesystem access.
pkgs/python/[email protected]/testing/example_scripts/customdirectory/conftest.py:13 
        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #644bb6119778c19c — Filesystem access.
pkgs/python/[email protected]/testing/example_scripts/perf_examples/collect_stats/generate_folders.py:9 
TEST_CONTENT = (HERE / "template_test.py").read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #170a6f354b06c7d5 — Filesystem access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:75 
            f = open(str(p), "w+", encoding="utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1c47cc4d01bacb6 — Filesystem access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:80 
                with open(str(p), encoding="utf8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ee29641e460f13d — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:188 
    monkeypatch.setitem(os.environ, "PY_COLORS", "1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43feaab0b875f4b3 — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:193 
    monkeypatch.setitem(os.environ, "PY_COLORS", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5e77d3296b2630a — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:198 
    monkeypatch.setitem(os.environ, "NO_COLOR", "1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da5b323ee175f6c2 — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:203 
    monkeypatch.setitem(os.environ, "FORCE_COLOR", "1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #197084bdaeeb37ca — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:221 
    monkeypatch.setitem(os.environ, "NO_COLOR", NO_COLOR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eba524cce310b130 — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:222 
    monkeypatch.setitem(os.environ, "FORCE_COLOR", FORCE_COLOR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82ccfd7327d2ab05 — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:228 
    monkeypatch.setitem(os.environ, "NO_COLOR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ebbe737fe5fc835 — Environment-variable access.
pkgs/python/[email protected]/testing/io/test_terminalwriter.py:229 
    monkeypatch.setitem(os.environ, "FORCE_COLOR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33b2e63caa3dbb0e — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:87 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1789640d87189582 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:661 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #781f041cd7233a46 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:684 
    with open(log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec59f83b74485631 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:700 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6c6bf31d02b295b — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:759 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0abc254a292b48d4 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:808 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b526d8d2120fa219 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:838 
    with open(log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0c44a7959524959 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:848 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #254eeb4779e9cd45 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:886 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e658a8dfcebbaf1c — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:918 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d6dc53e9b20f19f — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1055 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20f66a9de16770f0 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1089 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #990294b703a41713 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1123 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d994c8d90758602 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1165 
    with open(os.path.join(report_dir_base, "test_first"), encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5c8ccdfa85b1e2a — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1169 
    with open(os.path.join(report_dir_base, "test_second"), encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f651ffa87b2a5cf4 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1214 
    with open(test_first_log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfbb2ba16b57eb0b — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1217 
    with open(test_second_log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e255c7ab2b499227 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1223 
    with open(test_first_log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9f0b1dce394a477 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1228 
    with open(test_second_log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #befc63d8db4e0972 — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1553 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30132a4f0923f5cc — Filesystem access.
pkgs/python/[email protected]/testing/logging/test_reporting.py:1574 
    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6f0669ab028f219 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:57 
        p.write_text(
            textwrap.dedent(
                f"""\
                import x456
                def test():
                    assert x456.__file__.startswith({str(root2)!r})
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dae97f13aeafa86c — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:929 
        b.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.hookimpl(wrapper=True)
                def pytest_pycollect_makemodule():
                    mod = yield
                    mod.obj.hello = "world"
                    return mod
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de8bda789abb553d — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:942 
        b.joinpath("test_module.py").write_text(
            textwrap.dedent(
                """\
                def test_hello():
                    assert hello == "world"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cfc65120270a8e7 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:957 
        b.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.hookimpl(wrapper=True)
                def pytest_pycollect_makeitem():
                    result = yield
                    if result:
                        for func in result:
                            func._some123 = "world"
                    return result
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b178ec90b960360 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:972 
        b.joinpath("test_module.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture()
                def obj(request):
                    return request.node._some123
                def test_hello(obj):
                    assert obj == "world"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35f23b0de4488ffd — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1073 
    sub1.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            def pytest_runtest_setup(item):
                assert item.path.stem == "test_in_sub1"
            def pytest_runtest_call(item):
                assert item.path.stem == "test_in_sub1"
            def pytest_runtest_teardown(item):
                assert item.path.stem == "test_in_sub1"
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9927679b570529a7 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1087 
    sub2.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            def pytest_runtest_setup(item):
                assert item.path.stem == "test_in_sub2"
            def pytest_runtest_call(item):
                assert item.path.stem == "test_in_sub2"
            def pytest_runtest_teardown(item):
                assert item.path.stem == "test_in_sub2"
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d249ae5f39ee36b4 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1101 
    sub1.joinpath("test_in_sub1.py").write_text("def test_1(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13a1dc98cabd6bbf — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1102 
    sub2.joinpath("test_in_sub2.py").write_text("def test_2(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #725fb8ae92a489ee — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1484 
    fh.write_text(
        textwrap.dedent(
            """\
            import pytest
            def test_real():
                pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3abc1606a17c0cec — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1505 
    fh.write_text(
        textwrap.dedent(
            """\
            import pytest
            def test_real():
                pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4b9cbe22d91bf85 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1563 
    sub1_test.joinpath("test_in_sub1.py").write_text(
        "def test_1(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6abafe94efe84e72 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1566 
    sub2_test.joinpath("test_in_sub2.py").write_text(
        "def test_2(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f94746c89d84e562 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1612 
    root.joinpath("Test_root.py").write_text("def test_1(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #10f08d76a710280f — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1613 
    sub1.joinpath("Test_sub1.py").write_text("def test_2(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bc9b868e6be8504 — Filesystem access.
pkgs/python/[email protected]/testing/python/collect.py:1614 
    sub2_test.joinpath("test_sub2.py").write_text(
        "def test_3(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9113037bf6f765e — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:311 
        subdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture
                def spam():
                    return 'spam'
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a90a2ed779eece29 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:324 
        testfile.write_text(
            textwrap.dedent(
                """\
                def test_spam(spam):
                    assert spam == "spam"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0c9beb97d673b5e — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:385 
        subdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture(params=[1, 2, 3])
                def spam(request):
                    return request.param
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1fc296aaedf5b76 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:398 
        testfile.write_text(
            textwrap.dedent(
                """\
                params = {'spam': 1}

                def test_spam(spam):
                    assert spam == params['spam']
                    params['spam'] += 1
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d796cd413e819296 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:431 
        subdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture(params=[1, 2, 3])
                def spam(request):
                    return request.param
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64c65931a45e8588 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:444 
        testfile.write_text(
            textwrap.dedent(
                """\
                params = {'spam': 1}

                def test_spam(spam):
                    assert spam == params['spam']
                    params['spam'] += 1
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #920a3d4ce2b1a8b0 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:1233 
        b.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def arg1():
                    pass
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4dae30c60b246123 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:1245 
        p.write_text("def test_func(arg1): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd2b7c5abaf5181f — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:1958 
        package.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest
            @pytest.fixture
            def one():
                return 1
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e107fb3c4a0bafd3 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:1969 
        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                def test_x(one):
                    assert one == 1
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83eb5c6585cbec05 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:1981 
        sub.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def one():
                    return 2
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1153538e7f753ce1 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:1992 
        sub.joinpath("test_y.py").write_text(
            textwrap.dedent(
                """\
                def test_x(one):
                    assert one == 2
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c51164d2e500800 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2015 
        package.joinpath("__init__.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def setup_module():
                    values.append("package")
                def teardown_module():
                    values[:] = []
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #258a8086b3584f27 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2027 
        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def test_x():
                    assert values == ["package"]
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b8ba615f1b56477 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2038 
        package.joinpath("__init__.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def setup_module():
                    values.append("package2")
                def teardown_module():
                    values[:] = []
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ca7d4e822008537 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2050 
        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def test_x():
                    assert values == ["package2"]
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4ccd1ad54cc5429 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2071 
        package.joinpath("__init__.py").write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab8a1576f8a14bef — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2072 
        package.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                from .. import values
                @pytest.fixture(scope="package")
                def one():
                    values.append("package")
                    yield values
                    values.pop()
                @pytest.fixture(scope="package", autouse=True)
                def two():
                    values.append("package-auto")
                    yield values
                    values.pop()
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5648628ea93681dd — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2091 
        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def test_package_autouse():
                    assert values == ["package-auto"]
                def test_package(one):
                    assert values == ["package-auto", "package"]
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50d7c25d30b9f929 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2251 
        a.joinpath("test_something.py").write_text(
            "def test_func(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c4d084a5f30a34e — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2254 
        b.joinpath("test_otherthing.py").write_text(
            "def test_func(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87559b261378a2bb — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2293 
        pkgdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture(autouse=True)
                def app():
                    import sys
                    sys._myapp = "hello"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #550f7816bd3846bc — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:2309 
        t.write_text(
            textwrap.dedent(
                """\
                import sys
                def test_app():
                    assert sys._myapp == "hello"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e7825c13a12d8fc — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:3340 
        b.joinpath("test_overridden_fixture_finalizer.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def browser(browser):
                    browser['visited'] = True
                    return browser

                def test_browser(browser):
                    assert browser['visited'] is True
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df53562a848315ad — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:4318 
        fixfile.write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture(params=[0, 1, 2])
                def fix_with_param(request):
                    return request.param
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14dfaf6e4428f7e7 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:4332 
        testfile.write_text(
            textwrap.dedent(
                """\
                from fix import fix_with_param

                def test_foo(request):
                    request.getfixturevalue('fix_with_param')
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74396d24395749cb — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:4837 
        root.joinpath("__init__.py").write_text("values = []", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e8681c75919cc01 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:4841 
        sub1.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest
            from .. import values
            @pytest.fixture(scope="package")
            def fix():
                values.append("pre-sub1")
                yield values
                assert values.pop() == "pre-sub1"
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b862186b33027e2d — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:4855 
        sub1.joinpath("test_1.py").write_text(
            textwrap.dedent(
                """\
            from .. import values
            def test_1(fix):
                assert values == ["pre-sub1"]
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec414e48973057f5 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:4868 
        sub2.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest
            from .. import values
            @pytest.fixture(scope="package")
            def fix():
                values.append("pre-sub2")
                yield values
                assert values.pop() == "pre-sub2"
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3becd884989ee431 — Filesystem access.
pkgs/python/[email protected]/testing/python/fixtures.py:4882 
        sub2.joinpath("test_2.py").write_text(
            textwrap.dedent(
                """\
            from .. import values
            def test_2(fix):
                assert values == ["pre-sub2"]
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3148e189b9725a4d — Filesystem access.
pkgs/python/[email protected]/testing/python/metafunc.py:1585 
        sub1.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                def pytest_generate_tests(metafunc):
                    assert metafunc.function.__name__ == "test_1"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ff2fb99109d70ff — Filesystem access.
pkgs/python/[email protected]/testing/python/metafunc.py:1594 
        sub2.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                def pytest_generate_tests(metafunc):
                    assert metafunc.function.__name__ == "test_2"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ac23d77236a746f — Filesystem access.
pkgs/python/[email protected]/testing/python/metafunc.py:1603 
        sub1.joinpath("test_in_sub1.py").write_text(
            "def test_1(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f229c380351958c — Filesystem access.
pkgs/python/[email protected]/testing/python/metafunc.py:1606 
        sub2.joinpath("test_in_sub2.py").write_text(
            "def test_2(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb49eeef3b957203 — Filesystem access.
pkgs/python/[email protected]/testing/test_assertion.py:1879 
    a.joinpath("test_a.py").write_text("def test_a(): assert 1 == 2", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6401d9a4dedec026 — Filesystem access.
pkgs/python/[email protected]/testing/test_assertion.py:1880 
    a.joinpath("conftest.py").write_text(
        'def pytest_assertrepr_compare(): return ["summary a"]', encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c9e84cdc1796751 — Filesystem access.
pkgs/python/[email protected]/testing/test_assertion.py:1884 
    b.joinpath("test_b.py").write_text("def test_b(): assert 1 == 2", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #016dad125dd011c0 — Filesystem access.
pkgs/python/[email protected]/testing/test_assertion.py:1885 
    b.joinpath("conftest.py").write_text(
        'def pytest_assertrepr_compare(): return ["summary b"]', encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7712c03551c18eec — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:361 
        pkgdir.joinpath("__init__.py").write_text(
            "import pytest\n"
            "@pytest.fixture\n"
            "def special_asserter():\n"
            "    def special_assert(x, y):\n"
            "        assert x == y\n"
            "    return special_assert\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6b771830485a2fe — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:381 
        xdir.joinpath("test_Y").joinpath("__init__.py").write_text(
            "x = 2", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba0323dd8268f739 — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:998 
        pytester.path.joinpath("__pycache__").write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d79f9cda55445614 — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:1172 
        pkg.joinpath("test_blah.py").write_text(
            """
def test_rewritten():
    assert "@py_builtins" in globals()""",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f47fad1eb047e07c — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:1356 
        source.write_text("def test(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #073d0d2de6b2f92d — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:1359 
        contents = pyc.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bce3ed108f1a069b — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:1382 
        fn.write_text("def test(): assert True", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45125e3d3a69683c — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:1468 
        path.joinpath("test_foo.py").write_text(
            textwrap.dedent(
                """\
                class Test(object):
                    def test_foo(self):
                        import pkgutil
                        data = pkgutil.get_data('foo.test_foo', 'data.txt')
                        assert data == b'Hey'
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3d5b507073789cd — Filesystem access.
pkgs/python/[email protected]/testing/test_assertrewrite.py:1480 
        path.joinpath("data.txt").write_text("Hey", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb4fda709c9a4b95 — Filesystem access.
pkgs/python/[email protected]/testing/test_cacheprovider.py:64 
        pytester.path.joinpath(".pytest_cache").write_text(
            "gone wrong", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbb6cb8ebb61df26 — Filesystem access.
pkgs/python/[email protected]/testing/test_cacheprovider.py:1167 
        p1.write_text(
            "def test_1(): assert 1\ndef test_2(): assert 1\n", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3455a4b23ab7183 — Filesystem access.
pkgs/python/[email protected]/testing/test_cacheprovider.py:1239 
        p1.write_text(
            "import pytest\n"
            "@pytest.mark.parametrize('num', [1, 2, 3])\n"
            "def test_1(num): assert num\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9579be23afa3e429 — Filesystem access.
pkgs/python/[email protected]/testing/test_cacheprovider.py:1308 
    assert gitignore_path.read_text(encoding="UTF-8") == msg

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b25ddf756f6b92ff — Filesystem access.
pkgs/python/[email protected]/testing/test_cacheprovider.py:1311 
    gitignore_path.write_text("custom", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #123296a14c7f4c1e — Filesystem access.
pkgs/python/[email protected]/testing/test_cacheprovider.py:1318 
    assert gitignore_path.read_text(encoding="UTF-8") == "custom"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #259269f9de8e925b — Filesystem access.
pkgs/python/[email protected]/testing/test_cacheprovider.py:1359 
    assert cachedir_tag_path.read_bytes() == CACHEDIR_FILES["CACHEDIR.TAG"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76be665e2c29f7d5 — Filesystem access.
pkgs/python/[email protected]/testing/test_capture.py:796 
    sub1.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_runtest_setup(item):
                raise ValueError(42)
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1daeda76d57c3b9 — Filesystem access.
pkgs/python/[email protected]/testing/test_capture.py:805 
    sub1.joinpath("test_mod.py").write_text("def test_func1(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fc7fad6d5d8a519 — Filesystem access.
pkgs/python/[email protected]/testing/test_capture.py:1092 
        with open(tmpfile.name, "rb") as stmp_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1eb77a857c56616 — Filesystem access.
pkgs/python/[email protected]/testing/test_capture.py:1624 
    with open("caplog", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14155883fcf391c8 — Filesystem access.
pkgs/python/[email protected]/testing/test_capture.py:1631 
    with open("capstdout", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3babfd5f5b46a3dd — Filesystem access.
pkgs/python/[email protected]/testing/test_collect_imported_tests.py:16 
    src_file.write_text(
        textwrap.dedent("""\
            class Testament:
                def test_collections(self):
                    pass

            def test_testament(): pass
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c1fdd324b3c69f1 — Filesystem access.
pkgs/python/[email protected]/testing/test_collect_imported_tests.py:28 
    test_file.write_text(
        textwrap.dedent("""\
            from foo import Testament, test_testament

            class TestDomain:
                def test(self):
                    testament = Testament()
                    assert testament
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #558d9a62c1666502 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:151 
            x.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0d400319f0b149d — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:170 
        testfile.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a666003c9b62e29 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:189 
        testfile.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0c2368bc4f014d4 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:214 
        ensure_file(tmp_path / "mydir" / "test_hello.py").write_text(
            "def test_1(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9dd75e4c0f09e3bd — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:217 
        ensure_file(tmp_path / "xyz123" / "test_2.py").write_text(
            "def test_2(): 0/0", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd98579d3be87afe — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:220 
        ensure_file(tmp_path / "xy" / "test_ok.py").write_text(
            "def test_3(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35c6915c2813c81c — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:236 
        ensure_file(tmp_path / "a" / "test_1.py").write_text(
            "def test_a(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1e3697514173f5a — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:239 
        ensure_file(tmp_path / "b" / "tests" / "test_2.py").write_text(
            "def test_b(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f01b81ba7ec4b80 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:242 
        ensure_file(tmp_path / "c" / "tests" / "test_3.py").write_text(
            "def test_c(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e1f2f9857bf2c68 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:378 
        ensure_file(sub / "test_hello.py").write_text("syntax error", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcb83965edcb7dcd — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:379 
        sub.joinpath("conftest.py").write_text("syntax error", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ff7121901fd891b — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1138 
    foo_path.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def fix():
                return 1
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67c438aa8fcffad7 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1149 
    foo_path.joinpath("test_foo.py").write_text(
        "def test_foo(fix): assert fix == 1", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebbe5a2f43816cef — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1155 
    food_path.joinpath("test_food.py").write_text(
        "def test_food(fix): assert fix == 1", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6d9eba1b663aef9 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1295 
    pytester.path.joinpath("conftest.py").write_text(
        textwrap.dedent(
            f"""
            import os
            os.chdir({str(subdir)!r})
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6892bd7a148e4e24 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1331 
    testmod.joinpath("__init__.py").write_text(
        "def test_func(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2dda27bca0d58b9 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1334 
    testmod.joinpath("test_file.py").write_text(
        "def test_func(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #077938fd23be724e — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1339 
    root.joinpath("pytest.ini").write_text(
        textwrap.dedent(
            """
        [pytest]
        addopts = --pyargs
        testpaths = testmod
    """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c058488d94d7e4b — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1359 
    p.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """
            def pytest_sessionstart(session):
                raise Exception("pytest_sessionstart hook successfully run")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #314a4062c9123f6a — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1425 
    real.write_text(
        textwrap.dedent(
            """
        def test_nodeid(request):
            # Should not contain sub/ prefix.
            assert request.node.nodeid == "test_real.py::test_nodeid"
        """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf8f947aaf19e245 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1453 
    dir.joinpath("test_it.py").write_text("def test_it(): pass", "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88609ac801c747cb — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1462 
    tests.joinpath("conftest.py").write_text(
        "collect_ignore = ['ignore_me']", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa5ea920f1c19c53 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1469 
    ignore_me.joinpath("conftest.py").write_text(
        "assert 0, 'should_not_be_called'", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e28ba368b5bb9515 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1480 
    init.write_text("def test_init(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38cdc606421a4fa3 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1482 
    p.write_text("def test_file(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e165ac9c75abc57 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1517 
    init.write_text("def test_init(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f7c9a19c226cc75 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1535 
    sub.joinpath("test_file.py").write_text("def test_file(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9080f27b867a3949 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1573 
    pydir.joinpath("__init__.py").write_text("assert False", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ee86fba7b8a9a9f — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1780 
    test_file.write_text("def test(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a99f00f7d7b51b0b — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1803 
    (target / "test_chain.py").write_text("def test_chain(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d534f8d8f69ff9bd — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1880 
    tmp_path.joinpath("test_foo.py").write_text("def test(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #891f1e792360d21a — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1905 
    ensure_file(pytester.path / "test_eggs.py").write_text(
        f"print('{head}')", encoding="UTF-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #461905c692afeaf9 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1908 
    ensure_file(pytester.path / "test_ham.py").write_text(
        f"raise {exception_class.__name__}()", encoding="UTF-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5bb2f70bae2e9d2 — Filesystem access.
pkgs/python/[email protected]/testing/test_collection.py:1911 
    ensure_file(pytester.path / "test_spam.py").write_text(
        f"print('{tail}')", encoding="UTF-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f25d07df2e9c11f8 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:54 
        (tmp_path / filename).write_text(
            textwrap.dedent(
                f"""\
                [{section}]
                name = value
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb21479b4408f594 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:87 
        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """\
                [pytest]
                addopts = --verbose
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5ab4c38a5d8fcf6 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:141 
        pytester.path.joinpath(name).write_text(
            textwrap.dedent(
                f"""
            [{section}]
            minversion = 3.36
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81ddddb3730e9999 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:155 
        pytester.path.joinpath(name).write_text(
            textwrap.dedent(
                """
            [pytest]
            minversion = "3.36"
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a1f387abf0077ee — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:216 
        pytest_toml.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #124bdfcde090fcee — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:288 
        sub.joinpath("tox.ini").write_text(
            textwrap.dedent(
                """
            [pytest]
            minversion = 2.0
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #860a672c39a1ed0a — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:297 
        pytester.path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """
            [pytest]
            minversion = 1.5
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07bddb4d2f320fd2 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:310 
        pytester.path.joinpath("pytest.ini").write_text(
            "addopts = -x", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6bd0e750f4c30e6 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:328 
        pytester.path.joinpath("pytest.toml").write_text(
            """
            \\"
            """,
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a361e9e31e9a8412 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:834 
        p.write_text(f"mylist = {['.', str(somepath)]}", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c19e42ac81d2f6b — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:1426 
        p1.write_text(
            textwrap.dedent(
                """\
                [pytest]
                name = value
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58d9d79274c96ee0 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:1443 
        p2.write_text(
            textwrap.dedent(
                """\
                [pytest]
                name = wrong-value
                should_not_be_set = true
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b98a0b6677bee82 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:1935 
        inipath.write_text(contents, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d429d2f5bcec5fb — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:2027 
        p.write_text(contents, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a320840971cab079 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:2142 
        (tmp_path / "setup.cfg").write_text("[tool:pytest]\n", "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #304a868454bdeb21 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:2144 
        (tmp_path / "myproject" / "setup.cfg").write_text("[tool:pytest]\n", "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a15d6ad2aed7ad96 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:2164 
        pytester.path.joinpath(name).write_text(
            textwrap.dedent(
                f"""
            {section}
            custom = 1.0"""
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b12631c50af189c3 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:2818 
        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """\
                [pytest]
                addopts = --verbose
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb49c894b64e5bef — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:2839 
        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """\
                [pytest]
                addopts = --verbose
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b35af1f535d472c3 — Filesystem access.
pkgs/python/[email protected]/testing/test_config.py:2858 
        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                f"""\
                [pytest]
                addopts = --verbose
                {setting_name} = {TestVerbosity.SOME_OUTPUT_VERBOSITY_LEVEL}
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #364e767ca5e56422 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:49 
        tmp_path.joinpath("adir/conftest.py").write_text(
            "a=1 ; Directory = 3", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa53499f2dd5a98b — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:52 
        tmp_path.joinpath("adir/b/conftest.py").write_text(
            "b=2 ; a = 1.5", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #913c12a715d3d608 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:134 
    tmp_path.joinpath("adir-1.0/conftest.py").write_text(
        "a=1 ; Directory = 3", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db5bbfa50431ec0e — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:137 
    tmp_path.joinpath("adir-1.0/b/conftest.py").write_text(
        "b=2 ; a = 1.5", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a5b002dab4dacb4 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:270 
    x.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--xyz", action="store_true")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85cadace856519d3 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:298 
    tmp_path.joinpath("foo", "conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def fix(): return None
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93c0bf2fd1e2a450 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:308 
    tmp_path.joinpath("foo", "test_it.py").write_text(
        "def test_it(fix): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ef4544c16d941d8 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:429 
    x.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--xyz", action="store_true")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82ff13ede31cc4fc — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:469 
    ct2.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c1f52d23677a88f — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:493 
    sub.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest

            @pytest.fixture
            def not_needed():
                assert False, "Should not be called!"

            @pytest.fixture
            def foo():
                assert False, "Should not be called!"

            @pytest.fixture
            def bar(foo):
                return 'bar'
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8126186872ff771a — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:516 
    subsub.joinpath("test_bar.py").write_text(
        textwrap.dedent(
            """\
            import pytest

            @pytest.fixture
            def bar():
                return 'sub bar'

            def test_event_fixture(bar):
                assert bar == 'sub bar'
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a30ef5a9558a72c — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:537 
    sub.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--hello-world", action="store_true")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c958bcc46866002 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:547 
    p.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #852059698c96ddca — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:563 
        package.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def fxtr():
                    return "from-package"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2dff33b32e826f23 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:574 
        package.joinpath("test_pkgroot.py").write_text(
            textwrap.dedent(
                """\
                def test_pkgroot(fxtr):
                    assert fxtr == "from-package"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34f85f727320ee3a — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:587 
        swc.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def fxtr():
                    return "from-swc"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19f752b05eb2f898 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:598 
        swc.joinpath("test_with_conftest.py").write_text(
            textwrap.dedent(
                """\
                def test_with_conftest(fxtr):
                    assert fxtr == "from-swc"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01305a2c8eb1e6e1 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:611 
        snc.joinpath("test_no_conftest.py").write_text(
            textwrap.dedent(
                """\
                def test_no_conftest(fxtr):
                    assert fxtr == "from-package"   # No local conftest.py, so should
                                                    # use value from parent dir's
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1f039d5e7adb65d — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:685 
    src.joinpath("pytest.ini").write_text("[pytest]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #629c4fc8d9b71c92 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:686 
    src.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def fix1(): pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45f92216dd01f2d8 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:696 
    src.joinpath("test_foo.py").write_text(
        textwrap.dedent(
            """\
            def test_1(fix1):
                pass
            def test_2(out_of_reach):
                pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fdb8e027ed4d428 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:707 
    root.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def out_of_reach(): pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a2f3c003bbe6be7 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:811 
    sdk.joinpath("pyproject.toml").write_text(
        textwrap.dedent("""\
            [tool.pytest.ini_options]
            testpaths = ["../tests/sdk"]
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e761e3d9f9ea1e5b — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:821 
    tests_sdk.joinpath("conftest.py").write_text(
        textwrap.dedent("""\
            import pytest

            @pytest.fixture(autouse=True)
            def outer_fixture():
                pass
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab5296e0d6a0a568 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:831 
    tests_sdk.joinpath("test_outer.py").write_text(
        textwrap.dedent("""\
            def test_outer(request):
                fixturenames = request.fixturenames
                assert "outer_fixture" in fixturenames
                assert "inner_fixture" not in fixturenames
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b3f43432fa1e39d — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:843 
    inner.joinpath("conftest.py").write_text(
        textwrap.dedent("""\
            import pytest

            @pytest.fixture(autouse=True)
            def inner_fixture():
                pass
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #250ca8af550a348e — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:853 
    inner.joinpath("test_inner.py").write_text(
        textwrap.dedent("""\
            def test_inner(request):
                fixturenames = request.fixturenames
                assert "outer_fixture" in fixturenames
                assert "inner_fixture" in fixturenames
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3515235d0c5794c2 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:887 
    root.joinpath("conftest.py").write_text(
        textwrap.dedent("""\
            import pytest

            @pytest.fixture
            def ancestor_fixture():
                return "from-ancestor"
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0521932c80da7fce — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:899 
    sub.joinpath("pyproject.toml").write_text(
        "[tool.pytest.ini_options]\n", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05bb43266d6ce2d8 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:902 
    sub.joinpath("test_it.py").write_text(
        textwrap.dedent("""\
            def test_uses_ancestor(ancestor_fixture):
                assert ancestor_fixture == "from-ancestor"
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #608f0aafa69a3150 — Filesystem access.
pkgs/python/[email protected]/testing/test_conftest.py:917 
    x.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--xyz", action="store_true", required=True)
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8a38bd81c4a4283 — Filesystem access.
pkgs/python/[email protected]/testing/test_debugging.py:387 
        sub_dir.joinpath("conftest").with_suffix(".py").write_text(
            "import unknown", "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aba01c9c556c9a19 — Filesystem access.
pkgs/python/[email protected]/testing/test_debugging.py:390 
        sub_dir.joinpath("test_file").with_suffix(".py").write_text(
            "def test_func(): pass", "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2203fb0c7e31f6f3 — Filesystem access.
pkgs/python/[email protected]/testing/test_doctest.py:201 
        fn.write_text(doctest, encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c39c17fa02aad1af — Filesystem access.
pkgs/python/[email protected]/testing/test_doctest.py:350 
        pytester.path.joinpath("hello.py").write_text(
            textwrap.dedent(
                """\
                class Fun(object):
                    @property
                    def test(self):
                        '''
                        >>> a = 1
                        >>> 1/0
                        '''
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4888159ac11d5af7 — Filesystem access.
pkgs/python/[email protected]/testing/test_doctest.py:448 
        pytester.path.joinpath("hello.py").write_text(
            textwrap.dedent(
                """\
                import asdalsdkjaslkdjasd
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5355da4aff95a5ce — Filesystem access.
pkgs/python/[email protected]/testing/test_doctest.py:506 
        p.joinpath("__init__.py").write_text(
            textwrap.dedent(
                """\
                def somefunc():
                    '''
                        >>> i = 0
                        >>> i + 1
                        2
                    '''
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c57e275ed54304e1 — Filesystem access.
pkgs/python/[email protected]/testing/test_doctest.py:1365 
        assert Path("out").read_text("utf-8").split() == ["RUN"] * 2

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a58ec8a16528e655 — Filesystem access.
pkgs/python/[email protected]/testing/test_doctest.py:1687 
    not_setup_py.write_text(
        'from setuptools import setup; setup(name="foo")', encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6ca2e27dce7bb52 — Filesystem access.
pkgs/python/[email protected]/testing/test_doctest.py:1696 
    setup_py.write_text(f'from {mod} import setup; setup(name="foo")', "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d62d016e2a756a3d — Environment-variable access.
pkgs/python/[email protected]/testing/test_faulthandler.py:82 
                bool(os.environ.get("CI"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #577d76ca71cc5c62 — Environment-variable access.
pkgs/python/[email protected]/testing/test_faulthandler.py:123 
    "CI" in os.environ and sys.platform == "linux" and sys.version_info >= (3, 14),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fddf8b439a3ac18 — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:22 
        fn.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7a818b1ef78906e8 — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:28 
        fn.write_text("[pytest]\nx=1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32a9db1851a12b8c — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:36 
        fn.write_text("[pytest]\nx=1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53c7bb99079132f3 — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:44 
        fn.write_text("[custom]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3661e2cfb30fb58e — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:50 
        fn.write_text("[custom]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1e3166f25863d4d — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:56 
        fn.write_text("[tool:pytest]\nx=1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24dc99375efac968 — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:64 
        fn.write_text("[pytest]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1bcd53cf6bb7b17f — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:71 
        fn.write_text("]invalid toml[", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9af745b7d0b640f7 — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:78 
        fn.write_text(
            dedent(
                """
            [build_system]
            x = 1
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3789e88b7a386dda — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:93 
        fn.write_text(
            dedent(
                """
            [tool.pytest.ini_options]
            x = 1
            y = 20.0
            values = ["tests", "integration"]
            name = "foo"
            heterogeneous_array = [1, "str"]
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33f4cea3014274a7 — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:117 
        fn.write_text(
            dedent(
                """
                [tool.pytest]
                minversion = "7.0"
                xfail_strict = true
                testpaths = ["tests", "integration"]
                python_files = ["test_*.py", "*_test.py"]
                verbosity_assertions = 2
                maxfail = 5
                timeout = 300.5
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c778dcedaa91bdf — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:150 
        fn.write_text(
            dedent(
                """
            [tool.pytest]
            xfail_strict = true

            [tool.pytest.ini_options]
            minversion = "7.0"
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9465fcbf1459af7b — Filesystem access.
pkgs/python/[email protected]/testing/test_findpaths.py:168 
        fn.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f49368ab4a865e8 — Filesystem access.
pkgs/python/[email protected]/testing/test_helpconfig.py:129 
    assert "pytest_sessionstart" in p.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f236fb8088d89d11 — Filesystem access.
pkgs/python/[email protected]/testing/test_junitxml.py:542 
        p.write_text("def test_func(): 0/0", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ffd693d48a16e2d — Filesystem access.
pkgs/python/[email protected]/testing/test_junitxml.py:1058 
        pytester.path.joinpath("myfile.xyz").write_text("hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0405f7323f23e9fc — Filesystem access.
pkgs/python/[email protected]/testing/test_junitxml.py:1084 
    text = xmlf.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #580b04b0f83ec1ed — Filesystem access.
pkgs/python/[email protected]/testing/test_junitxml.py:1106 
    text = xmlf.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcac7ab413c179da — Filesystem access.
pkgs/python/[email protected]/testing/test_link_resolve.py:58 
    p.write_text(
        textwrap.dedent(
            """
        import pytest
        def test_foo():
            raise AssertionError()
        """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8f9de1d35d59b74 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:169 
        os.environ[key] = "world"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb41206b9f6c329c — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:172 
    del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84f9328045be51df — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:175 
        assert os.environ[key] == "world"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ced9f507050d9413 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:176 
        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40be14f9796ac11c — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:178 
        assert key not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9bd3c9fb523faaa — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:205 
    assert os.environ["XYZ123"] == "2"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49a6570595a202b2 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:207 
    assert "XYZ123" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a6fa653c89810d4 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:212 
    assert name not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #430b3fea65a7fcf2 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:218 
    os.environ[name] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bdb2d42c01b1603 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:222 
        assert name not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34e3747928d801bd — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:224 
        assert os.environ[name] == "3"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db4725ce33e21021 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:226 
        assert os.environ[name] == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9bdae9b6c110b0f2 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:228 
        if name in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c11034ce55d44b59 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:229 
            del os.environ[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc4a6848c8c0b74a — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:257 
    assert os.environ["XYZ123"] == "3-2"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2564981d088bfb6 — Environment-variable access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:259 
    assert "XYZ123" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bd24e57a758347e — Filesystem access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:342 
    p.joinpath("a.py").write_text(
        textwrap.dedent(
            """\
        import doesnotexist

        x = 1
    """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ffc99772109538a — Filesystem access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:352 
    pytester.path.joinpath("test_importerror.py").write_text(
        textwrap.dedent(
            """\
        def test_importerror(monkeypatch):
            monkeypatch.setattr('package.a.x', 2)
    """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7aa70ce9358536d4 — Filesystem access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:466 
        ns.joinpath("__init__.py").write_text(
            "__import__('pkg_resources').declare_namespace(__name__)", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b3b2261844786c29 — Filesystem access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:471 
        lib.joinpath("__init__.py").write_text(
            f"def check(): return {dirname!r}", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7610a52a7139cf2 — Filesystem access.
pkgs/python/[email protected]/testing/test_monkeypatch.py:500 
    modules_tmpdir.joinpath("main_app.py").write_text("app = True", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6bec62c7574a1101 — Filesystem access.
pkgs/python/[email protected]/testing/test_parseopt.py:143 
        args_file.write_text("\n".join(tests), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1d1224d4513c5e6 — Filesystem access.
pkgs/python/[email protected]/testing/test_parseopt.py:311 
    with open(str(script), "w", encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60ee43bfc396fa38 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:147 
        samplefile.write_text("samplefile\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2718337371050dca — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:150 
        execfile.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c8b5cfe9a69b4d9 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:153 
        execfilepy.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #694bedeb18dfd148 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:167 
        module_a.write_text("from .b import stuff as result\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8c3a687a30644d9 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:169 
        module_b.write_text('stuff="got it"\n', encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #810ef2eec95fde41 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:171 
        module_c.write_text(
            dedent(
                """
            import pluggy;
            import otherdir.a
            value = otherdir.a.result
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3294b095aa49ba65 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:182 
        module_d.write_text(
            dedent(
                """
            import pluggy;
            from otherdir import a
            value2 = a.result
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f142507bc23d0ab6 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:355 
        fn.write_text("def foo(x): return 40 + x", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cb9d7f9fca63e43 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:559 
    module_path.write_text("def foo(): return 42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e22677000924e568 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:603 
        fn.write_text(
            dedent(
                """
                from dataclasses import dataclass

                @dataclass
                class Data:
                    value: str
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48f55b535e2f75e0 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:636 
        fn.write_text(
            dedent(
                """
                import pickle

                def _action():
                    return 42

                def round_trip():
                    s = pickle.dumps(_action)
                    return pickle.loads(s)
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2a2be610343254f — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:674 
        fn1.write_text(
            dedent(
                """
                import dataclasses
                import pickle

                @dataclasses.dataclass
                class Data:
                    x: int = 42
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b9b2ca7a8f02ccb — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:690 
        fn2.write_text(
            dedent(
                """
                import dataclasses
                import pickle

                @dataclasses.dataclass
                class Data:
                    x: str = ""
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02da71f994568422 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:821 
        file_path.write_text("my_name='demo'", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4ad2e8e781ddbcd — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:824 
            (tmp_path / "a/b/__init__.py").write_text(
                "my_name='b.__init__'", encoding="utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7247857c60d8deaa — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:890 
        init.write_text(
            dedent(
                """
                from .singleton import Singleton

                instance = Singleton()
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fa97595c2c316be — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:901 
        singleton.write_text(
            dedent(
                """
                class Singleton:
                    INSTANCES = []

                    def __init__(self) -> None:
                        self.INSTANCES.append(self)
                        if len(self.INSTANCES) > 1:
                            raise RuntimeError("Already initialized")
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #408b1d816689dd56 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:955 
        file_path.write_text(
            dedent(
                """
            def test_demo():
                pass
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #040f7aeabf5d62f7 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:992 
        core_py.write_text(
            dedent(
                """
                def foo():
                    '''
                    >>> 1 + 1
                    2
                    '''
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e648a7fb07e7aecd — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1019 
        conftest_path1.write_text(
            dedent(
                """
                import pytest
                @pytest.fixture
                def a_fix(): return "a"
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bda4b9385416deb9 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1030 
        test_path1.write_text(
            dedent(
                """
                import app.core
                def test(a_fix):
                    assert a_fix == "a"
                """,
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e73f89e6a8924e4 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1043 
        conftest_path2.write_text(
            dedent(
                """
                import pytest
                @pytest.fixture
                def b_fix(): return "b"
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ce0fec8d3979973 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1055 
        test_path2.write_text(
            dedent(
                """
                import app.core
                def test(b_fix):
                    assert b_fix == "b"
                """,
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13238e0834eb0f71 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1175 
        x_at_root.write_text("raise AssertionError('x at root')", encoding="ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f18d55b9f3a2978 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1181 
        x_in_sub_dir.write_text("X = 'a/b/x'", encoding="ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da30d5519ba52ae1 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1400 
        (tmp_path / "src/dist1/com/company/app/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4518b89f55a72347 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1403 
        (tmp_path / "src/dist1/com/company/app/core/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41a116b07107c769 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1410 
        (tmp_path / "src/dist2/com/company/calc/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63fdd6b7640151e2 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1413 
        (tmp_path / "src/dist2/com/company/calc/algo/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99266da35f22879f — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1417 
        algorithms_py.write_text(code, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #572132bfa4ea27c0 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1503 
        test_py.write_text(code, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c35241a4b3520a2 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1532 
        file.write_text("data=123", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25b4d0e8dd10751c — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1537 
        tests.write_text(
            dedent(
                """
            from cow.moo.moo import data

            def test_moo():
                print(data)
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #777b0d86c27b3191 — Filesystem access.
pkgs/python/[email protected]/testing/test_pathlib.py:1693 
    test_y.write_text("def test(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f8c1a25c59012b0 — Environment-variable access.
pkgs/python/[email protected]/testing/test_pluginmanager.py:351 
        monkeypatch.setitem(os.environ, "PYTEST_PLUGINS", "xy123")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1cdbc25f680d12e — Filesystem access.
pkgs/python/[email protected]/testing/test_pluginmanager.py:409 
        pytester.mkpydir("pkg").joinpath("plug.py").write_text("x=3", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55f91cc014683449 — Filesystem access.
pkgs/python/[email protected]/testing/test_pytester.py:218 
    assert "mixed_encoding = 'São Paulo'".encode() in p.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85dbe04bdc3ef754 — Filesystem access.
pkgs/python/[email protected]/testing/test_pytester.py:227 
        test_mod.write_text("def test_foo(): assert False", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bbb64053a858769 — Environment-variable access.
pkgs/python/[email protected]/testing/test_pytester.py:613 
    assert "PYTEST_ADDOPTS" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8dfe114087612b6c — Environment-variable access.
pkgs/python/[email protected]/testing/test_pytester.py:705 
    assert os.environ.get("HOME") == tmphome

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8443ee3f00e04a64 — Filesystem access.
pkgs/python/[email protected]/testing/test_python_path.py:38 
    foo_py.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #294607951b2df01f — Filesystem access.
pkgs/python/[email protected]/testing/test_python_path.py:47 
    bar_py.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be528f1e68c278fb — Filesystem access.
pkgs/python/[email protected]/testing/test_python_path.py:76 
    localplugin_py.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1ac76e38e65f6987 — Filesystem access.
pkgs/python/[email protected]/testing/test_reports.py:411 
        sub_dir.joinpath("conftest.py").write_text("import unknown", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edc58dadf7f0d17e — Environment-variable access.
pkgs/python/[email protected]/testing/test_runner.py:1086 
    assert "PYTEST_CURRENT_TEST" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77883c6338f954cd — Environment-variable access.
pkgs/python/[email protected]/testing/test_runner.py:1225 
    assert os.environ["PYTEST_VERSION"] == "old version"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa003d8edbf87d91 — Filesystem access.
pkgs/python/[email protected]/testing/test_session.py:273 
    hellodir.joinpath("test_hello.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bba05bf96660b78 — Filesystem access.
pkgs/python/[email protected]/testing/test_session.py:275 
    hello2dir.joinpath("test_hello2.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3eb8af752dc22ca0 — Filesystem access.
pkgs/python/[email protected]/testing/test_session.py:284 
    hellodir.joinpath("test_hello.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de00af5e4a48b975 — Filesystem access.
pkgs/python/[email protected]/testing/test_session.py:286 
    hello2dir.joinpath("test_hello2.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cb6361e49aa222a — Filesystem access.
pkgs/python/[email protected]/testing/test_session.py:288 
    hello3dir.joinpath("test_hello3.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83f415a7a6520345 — Filesystem access.
pkgs/python/[email protected]/testing/test_session.py:290 
    subdir.joinpath("test_hello4.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae93d2225ffd627d — Filesystem access.
pkgs/python/[email protected]/testing/test_skipping.py:191 
        root.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            def pytest_markeval_namespace():
                return {"arg": "root"}
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #326e5a9b099f7d7f — Filesystem access.
pkgs/python/[email protected]/testing/test_skipping.py:202 
        root.joinpath("test_root.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            @pytest.mark.skipif("arg == 'root'")
            def test_root():
                assert False
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11826b776ba7a7c5 — Filesystem access.
pkgs/python/[email protected]/testing/test_skipping.py:217 
        foo.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            def pytest_markeval_namespace():
                return {"arg": "foo"}
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ceb6c286e77a3274 — Filesystem access.
pkgs/python/[email protected]/testing/test_skipping.py:228 
        foo.joinpath("test_foo.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            @pytest.mark.skipif("arg == 'foo'")
            def test_foo():
                assert False
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d068d135da6b0d9d — Filesystem access.
pkgs/python/[email protected]/testing/test_skipping.py:243 
        bar.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            def pytest_markeval_namespace():
                return {"arg": "bar"}
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42b77a9a6a305b52 — Filesystem access.
pkgs/python/[email protected]/testing/test_skipping.py:254 
        bar.joinpath("test_bar.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            @pytest.mark.skipif("arg == 'bar'")
            def test_bar():
                assert False
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66cf62f3ecdac5b7 — Filesystem access.
pkgs/python/[email protected]/testing/test_stepwise.py:534 
    cache_file.write_text(json.dumps({"invalid": True}), encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65fa67458aa1a5b2 — Filesystem access.
pkgs/python/[email protected]/testing/test_terminal.py:271 
        a.joinpath("test_hello123.py").write_text(
            textwrap.dedent(
                """\
                class TestClass(object):
                    def test_method(self):
                        pass
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6cc6dc414e2271a8 — Filesystem access.
pkgs/python/[email protected]/testing/test_terminal.py:1645 
        pytester.mkdir("a").joinpath("conftest.py").write_text(
            """
def pytest_report_header(config, start_path):
    return ["line1", str(start_path)]
""",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d907cc7864562d47 — Filesystem access.
pkgs/python/[email protected]/testing/test_terminal.py:3386 
        test_path.write_text(
            textwrap.dedent(
                """
                import pytest

                @pytest.mark.parametrize("a", ["x/y", "C:/path", "\\\\", "C:\\\\path", "a::b/"])
                def test_x(a):
                    assert False
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-docx

python dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #03acbffc7a844863 — Filesystem access.
pkgs/python/[email protected]/src/docx/image/image.py:41 
            with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #684793651fd41822 — Filesystem access.
pkgs/python/[email protected]/src/docx/opc/phys_pkg.py:47 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b11ccad0ad29b3b2 — Filesystem access.
pkgs/python/[email protected]/src/docx/parts/comments.py:49 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #826beba900a7ae75 — Filesystem access.
pkgs/python/[email protected]/src/docx/parts/hdrftr.py:31 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24b8d6bab42b5dd7 — Filesystem access.
pkgs/python/[email protected]/src/docx/parts/hdrftr.py:51 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1cae7269833b4de — Filesystem access.
pkgs/python/[email protected]/src/docx/parts/settings.py:48 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0a8505c52784021 — Filesystem access.
pkgs/python/[email protected]/src/docx/parts/styles.py:40 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-dotenv

python dependency
expand_more 11 low-confidence finding(s)
low env_fs dependency Excluded from app score #adaa82692f990fdf — Filesystem access.
pkgs/python/[email protected]/src/dotenv/cli.py:76 
        with open(path) as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0f5b66afe8617be — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/cli.py:194 
        if v is not None and (override or k not in os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95cfab0267067b8e — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/cli.py:225 
    cmd_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f6a7df7016cd786 — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/main.py:26 
    if "PYTHON_DOTENV_DISABLED" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5235dc37190d0629 — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/main.py:28 
    value = os.environ["PYTHON_DOTENV_DISABLED"].casefold()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13091d8d4f3dff84 — Filesystem access.
pkgs/python/[email protected]/src/dotenv/main.py:63 
            with open(self.dotenv_path, encoding=self.encoding) as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2420141b72d34d6a — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/main.py:105 
            if k in os.environ and not self.override:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de1413e7cfd76bf4 — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/main.py:108 
                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58fc980594b74de2 — Filesystem access.
pkgs/python/[email protected]/src/dotenv/main.py:148 
        source: IO[str] = open(path, encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a7cd9011686d8b1 — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/main.py:302 
                env.update(os.environ)  # type: ignore

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5747f86e2acb36aa — Environment-variable access.
pkgs/python/[email protected]/src/dotenv/main.py:306 
                env.update(os.environ)  # type: ignore

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-multipart

python dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #313c5f9ab31b5a08 — Filesystem access.
pkgs/python/[email protected]/python_multipart/multipart.py:516 
                tmp_file = open(path, "w+b")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-pptx

python dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #ace88c097e828d79 — Filesystem access.
pkgs/python/[email protected]/features/steps/picture.py:43 
    with open(test_image(filename), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2d81d46230c2419 — Filesystem access.
pkgs/python/[email protected]/features/steps/placeholder.py:141 
    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d175ff92f473580 — Filesystem access.
pkgs/python/[email protected]/features/steps/presentation.py:88 
    with open(test_pptx("test"), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1a01ff797f70ec1 — Filesystem access.
pkgs/python/[email protected]/features/steps/presentation.py:107 
    with open(saved_pptx_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b681060f6a0a3b58 — Filesystem access.
pkgs/python/[email protected]/features/steps/shape.py:461 
    with open(test_file("just-two-mice.png"), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27f55bed65abdbcf — Filesystem access.
pkgs/python/[email protected]/features/steps/shapes.py:65 
    with open(test_file(filename), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c2cebeef7ade371 — Filesystem access.
pkgs/python/[email protected]/src/pptx/media.py:37 
            with open(movie_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb2f7b5144e325a6 — Filesystem access.
pkgs/python/[email protected]/src/pptx/opc/package.py:367 
            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5e057d67ac5656e — Filesystem access.
pkgs/python/[email protected]/src/pptx/opc/serialized.py:166 
            with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #954bc275dc234c0b — Filesystem access.
pkgs/python/[email protected]/src/pptx/oxml/__init__.py:29 
    with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0f0de110ca8e064 — Filesystem access.
pkgs/python/[email protected]/src/pptx/parts/image.py:163 
            with open(image_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66ec737a2a4c29ff — Environment-variable access.
pkgs/python/[email protected]/src/pptx/text/fonts.py:80 
        home = os.environ.get("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30b6321c54f0368c — Filesystem access.
pkgs/python/[email protected]/src/pptx/text/fonts.py:200 
        return cls(open(path, "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytz

python dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #6ff124a84161d8cf — Environment-variable access.
pkgs/python/[email protected]/pytz/__init__.py:91 
    zoneinfo_dir = os.environ.get('PYTZ_TZDATADIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af793f728cd1685c — Filesystem access.
pkgs/python/[email protected]/pytz/__init__.py:118 
    return open(filename, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce92594c5039cf9f — Environment-variable access.
pkgs/python/[email protected]/pytz/__init__.py:124 
        if os.environ.get('PYTZ_SKIPEXISTSCHECK', ''):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bb8c5efb3712163 — Filesystem access.
pkgs/python/[email protected]/pytz/tzfile.py:130 
                      open(os.path.join(base, 'Australia', 'Melbourne'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a4f1620985ef091 — Filesystem access.
pkgs/python/[email protected]/pytz/tzfile.py:132 
                      open(os.path.join(base, 'US', 'Eastern'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c742110190f0adf7 — Filesystem access.
pkgs/python/[email protected]/setup.py:31 
    long_description=open('README.rst', 'r').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

qdrant-client

python dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #a5565e2e81abc127 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/embed/schema_parser.py:298 
        with open(output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3cf83cdbda5d78db — Filesystem access.
pkgs/python/[email protected]/qdrant_client/embed/utils.py:76 
    with open(path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86727eda8f1e1b0a — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:99 
            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52e288084f766755 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:102 
            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #123fd5ccda340cb5 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:125 
            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18fab4aaf161ea5b — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:127 
        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b91b4c48200e06e — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:146 
        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02506fc089180638 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:102 
            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1927aaba41d25b77 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:105 
            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a58a6adde2f2aab8 — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:136 
            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d82068cfd5f86cd — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:138 
        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a29d25c0650bd6d — Filesystem access.
pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:162 
        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ruff

python dependency
expand_more 10 low-confidence finding(s)
low env_fs dependency Excluded from app score #3071d79847b671ac — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_ast/generate.py:1171 
    out_path.write_text(rustfmt("\n".join(out)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #030343bf563e5fd5 — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_formatter/generate.py:24 
nodes_file = (
    root.joinpath("crates")
    .joinpath("ruff_python_ast")
    .joinpath("src")
    .joinpath("generated.rs")
    .read_text()
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #426fcca721c272bf — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_formatter/generate.py:118 
        node_path.write_text(rustfmt(code))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2af36e5594a968f6 — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_formatter/generate.py:176 
out.write_text(rustfmt(generated))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78568067bdd4ae6f — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_parser/resources/inline/err/debug_shadow_with.py:1 
with open("foo.txt") as __debug__: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7734a9a8fb0e9c00 — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_parser/resources/inline/ok/single_parenthesized_item_context_manager_py38.py:2 
with (
  open('foo.txt')) as foo: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdf43a25d0da8a09 — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_parser/resources/inline/ok/single_parenthesized_item_context_manager_py38.py:4 
with (
  open('foo.txt')): ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7134710179b66fa7 — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_parser/resources/valid/statement/ambiguous_lpar_with_items.py:61 
with (open('a.py')), (open('b.py')): ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6989a80545de1b01 — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_parser/resources/valid/statement/with.py:13 
with open() as f: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b848cb5515569416 — Filesystem access.
pkgs/python/[email protected]/crates/ruff_python_parser/resources/valid/statement/with.py:14 
with open() as f.attr: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

setuptools

python dependency
expand_more 162 low-confidence finding(s)
low env_fs dependency Excluded from app score #8cd1d21de071dcd8 — Environment-variable access.
pkgs/python/[email protected]/_distutils_hack/__init__.py:49 
    which = os.environ.get('SETUPTOOLS_USE_DISTUTILS', 'local')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #273a7921d0791492 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/command/_framework_compat.py:22 
    ensurepip = os.environ.get("ENSUREPIP_OPTIONS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #139da039bee082a3 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/bdist_rpm.py:555 
                    with open(val) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06664cd377f4f447 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/command/build_ext.py:800 
                elif '_PYTHON_HOST_PLATFORM' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fe7af96042d9a5c2 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/build_scripts.py:105 
            with open(outfile, "w", encoding=f.encoding) as outf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0be00fbbe28ddfc6 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/config.py:104 
        with open(filename, "w", encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82177ef2e75c8714 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/config.py:191 
        with open(out, encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edcd8128ee6b909f — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/config.py:348 
    log.info(pathlib.Path(filename).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99032136b26ce57a — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/install_egg_info.py:55 
        with open(target, 'w', encoding='UTF-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2dfb9b81503c54c1 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/sdist.py:424 
        with open(self.manifest, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #168aa0029afb736f — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/command/sdist.py:434 
        with open(self.manifest, encoding='utf-8') as lines:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2aeaea6b235b8787 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/cygwin.py:73 
        self.cc = os.environ.get('CC', self.cc or 'gcc')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40ce1616d9760aa7 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/cygwin.py:74 
        self.cxx = os.environ.get('CXX', self.cxx or 'g++')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af8b074d1a9c7a0d — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/cygwin.py:318 
        config_h = pathlib.Path(fn).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69a5ad2ba8bd4b18 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:82 
    root = os.environ.get("ProgramFiles(x86)") or os.environ.get("ProgramFiles")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfd129ba2e3daed6 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:151 
    if os.getenv("DISTUTILS_USE_SDK"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfbcb0606c80af2e — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:152 
        return {key.lower(): value for key, value in os.environ.items()}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4810e6363bef959 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:190 
        paths = os.getenv('path').split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #872ca4d6a0b0c627 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:562 
        env = dict(os.environ, PATH=self._paths)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45c3f7014f928d98 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/compilers/C/zos.py:114 
            if (binary := os.environ.get(envvar, None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffc0b3e791944274 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/debug.py:5 
DEBUG = os.environ.get('DISTUTILS_DEBUG')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa6e94f10347d7f9 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/dist.py:387 
            yield pathlib.Path(os.getenv("DIST_EXTRA_CONFIG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a13683c7785cd18 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/dist.py:1141 
            self.read_pkg_file(open(path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #00ee6c6d63cfb4b8 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/dist.py:1216 
        with open(
            os.path.join(base_dir, 'PKG-INFO'), 'w', encoding='UTF-8'
        ) as pkg_info:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55f62ec2223cc8d7 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/file_util.py:28 
            fsrc = open(src, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a4e1a201e4c0239 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/file_util.py:39 
            fdst = open(dst, 'wb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #335ce97a7e73b9a1 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/file_util.py:227 
    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2dac990b1e349590 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/spawn.py:52 
    return os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #408f7a6b77cb569e — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/spawn.py:111 
        path = os.environ.get('PATH', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56ec74c998580a5f — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:48 
if "_PYTHON_PROJECT_BASE" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b9d0687578de467 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:49 
    project_base = os.path.abspath(os.environ["_PYTHON_PROJECT_BASE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68d5b8494817077c — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:330 
        if 'CC' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54d5308df978dcf0 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:331 
            newcc = os.environ['CC']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50909342231439c9 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:332 
            if 'LDSHARED' not in os.environ and ldshared.startswith(cc):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2f562018abd3653 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:337 
        cxx = os.environ.get('CXX', cxx)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b7e167b2bea2917 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:338 
        ldshared = os.environ.get('LDSHARED', ldshared)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5195f5a1d63ad88 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:339 
        ldcxxshared = os.environ.get('LDCXXSHARED', ldcxxshared)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ef9ca65c27a121a — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:340 
        cpp = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b35c7abe62b2a78c — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:340 
        cpp = os.environ.get(
            'CPP',
            cc + " -E",  # not always
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21140d7ebd408b4e — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:347 
        cflags = os.environ.get('CFLAGS', cflags)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0c27f18ae6fa41e — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:349 
        cxxflags = os.environ.get('CXXFLAGS', cxxflags)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eeae3ad92516932e — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:357 
        ar = os.environ.get('AR', ar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6c75c864e80d49d — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:359 
        archiver = ar + ' ' + os.environ.get('ARFLAGS', ar_flags)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fba9e27da692668 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:376 
        if 'RANLIB' in os.environ and compiler.executables.get('ranlib', None):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #36d1e2f7c4ba39e2 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:377 
            compiler.set_executables(ranlib=os.environ['RANLIB'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efdad2716eba184c — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:472 
                elif n in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4fc57138a3f3ab8f — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:474 
                    item = os.environ[n]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b37a0511ee448b67 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:597 
    flags = os.environ.get(f'{type}FLAGS')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40c88066085330c9 — Filesystem access.
pkgs/python/[email protected]/setuptools/_distutils/text_file.py:118 
        self.file = open(self.filename, errors=self.errors, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1d9917e9345fe2a — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/util.py:57 
        target = os.environ.get('VSCMD_ARG_TGT_ARCH')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8626e4759ab7eaab — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/util.py:94 
    env_ver = os.environ.get(MACOSX_VERSION_VAR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b079fe1f9effe65 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/util.py:174 
    if os.name == 'posix' and 'HOME' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b18fc355d5ea5076 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/util.py:178 
            os.environ['HOME'] = pwd.getpwuid(os.getuid())[5]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67f79f108a19fff4 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/util.py:184 
    if 'PLAT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f42cf0d0b440162d — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/util.py:185 
        os.environ['PLAT'] = get_platform()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #343659f65cc52a55 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_distutils/util.py:199 
    lookup = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b4070d0ea19275a — Filesystem access.
pkgs/python/[email protected]/setuptools/_imp.py:65 
            file = open(path, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95846f01c3bdb8b6 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_path.py:80 
    orig_pythonpath = os.environ.get('PYTHONPATH', nothing)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb1bada27e1a09c3 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_path.py:81 
    current_pythonpath = os.environ.get('PYTHONPATH', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c60e9e7479993bc — Environment-variable access.
pkgs/python/[email protected]/setuptools/_path.py:87 
            os.environ['PYTHONPATH'] = new_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a7e71b240e74e4a — Environment-variable access.
pkgs/python/[email protected]/setuptools/_path.py:91 
            os.environ.pop('PYTHONPATH', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7776704b6c6e905 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_path.py:93 
            os.environ['PYTHONPATH'] = orig_pythonpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc725428d775d505 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_scripts.py:49 
        return os.environ.get('__PYVENV_LAUNCHER__', _default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5befc800d7c69059 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_scripts.py:238 
        launcher = os.environ.get('SETUPTOOLS_LAUNCHER', 'executable')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fa2128c1f15ed0a7 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_scripts.py:245 
        if ext not in os.environ['PATHEXT'].lower().split(';'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da08d3aa4701319d — Filesystem access.
pkgs/python/[email protected]/setuptools/_scripts.py:332 
    return resources.files('setuptools').joinpath(launcher_fn).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cbd598a67e5610c — Filesystem access.
pkgs/python/[email protected]/setuptools/_scripts.py:337 
    return res.read_text(encoding='utf-8') % vars()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45550cdf7ea93e1e — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/autocommand/autoparse.py:330 
        with open(filename_or_file, *args, **kwargs) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0407f24080b85c12 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/backports/tarfile/__init__.py:2829 
            t = open(fileobj=name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #952f69d7f389fda3 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/backports/tarfile/__init__.py:2832 
            t = open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3be667513521da8f — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/backports/tarfile/__init__.py:2872 
            with open(src, 'r') as tar:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1b6b5e7f1242785 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:379 
        return self.locate().read_text(encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f9a3257b5b529348 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:382 
        return self.locate().read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #814a5221898fad29 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:527 
            self.read_text('METADATA')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbe033d02d0fdc08 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:528 
            or self.read_text('PKG-INFO')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c64428115e0b54fc — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:532 
            or self.read_text('')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fcf91390e213900 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:567 
        return EntryPoints._from_text_for(self.read_text('entry_points.txt'), self)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6600340add99eb00 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:616 
        text = self.read_text('RECORD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c53231b6593d463f — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:630 
        text = self.read_text('installed-files.txt')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cebe665784812212 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:659 
        text = self.read_text('SOURCES.txt')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55a97177a6ec6614 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:672 
        source = self.read_text('requires.txt')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da5d35ad41286bf0 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:723 
            self.read_text(filename),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ce1cc8680113d48 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:1014 
            return self._path.joinpath(filename).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bf4513651dfa5da — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:1150 
    return (dist.read_text('top_level.txt') or '').split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #187d06e07efa96a3 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/jaraco/text/__init__.py:232 
lorem_ipsum: str = (
    files(__name__).joinpath('Lorem ipsum.txt').read_text(encoding='utf-8')
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6d4177ca4c30060 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/jaraco/text/__init__.py:631 
    with open(filename, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a799be75b32fd3a5 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/packaging/_manylinux.py:34 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53df6bb295188c50 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/packaging/_musllinux.py:46 
        with open(executable, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c43ec743d98185f — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/__init__.py:31 
    if os.getenv("ANDROID_DATA") == "/data" and os.getenv("ANDROID_ROOT") == "/system":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6ce8fc835fc3729 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/__init__.py:32 
        if os.getenv("SHELL") or os.getenv("PREFIX"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #577dc475b57e06a7 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:45 
        path = os.environ.get("XDG_DATA_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2bb7460bda7de3bc — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:52 
        path = os.environ.get("XDG_DATA_DIRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d524dd3389f1296a — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:76 
        path = os.environ.get("XDG_CONFIG_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1c5e09008043487 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:83 
        path = os.environ.get("XDG_CONFIG_DIRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #575f0de1e7d91d9f — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:107 
        path = os.environ.get("XDG_CACHE_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fb250457d1c52d7 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:123 
        path = os.environ.get("XDG_STATE_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bce373ed8bea38be — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:177 
        path = os.environ.get("XDG_RUNTIME_DIR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #407afa8c8f6e072c — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:201 
        path = os.environ.get("XDG_RUNTIME_DIR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #603a77423eb2b082 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:238 
        media_dir = os.environ.get(env_var, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #adb439fc48416bd1 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:157 
    result = os.environ.get(env_var_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #534914e32ebec011 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:167 
        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Documents")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f3c4e4d4149838b — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:170 
        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Downloads")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9194c32869022b1 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:173 
        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Pictures")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b322dc163ae7b1e8 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:176 
        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Videos")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16702296c1b56ff4 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:179 
        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Music")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52acc4c4b551aebb — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_bdist_wheel.py:492 
        with open(wheelfile_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97bd7284c2525df5 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_bdist_wheel.py:598 
            with open(dependency_links_path, encoding="utf-8") as dependency_links_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9672c9bd542da674 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_bdist_wheel.py:609 
        with open(pkg_info_path, "w", encoding="utf-8") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58cd68810b0faf66 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:171 
                        requires = path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a92a1240a5f4569 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:174 
                        pkginfo = path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12a5c09f03f719bb — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:184 
                            path.read_bytes(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33b7d862f60ac575 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:190 
                yield str(path.relative_to(self.path)), path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f535368802ab837f — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/pack.py:40 
    with open(wheel_file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2723c083e3dcbc7f — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/pack.py:60 
            with open(wheel_file_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1113033c328303a — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_metadata.py:151 
    with open(pkginfo_path, encoding="utf-8") as headers:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4eabfe603d7fec54 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/_metadata.py:160 
        with open(requires_path, encoding="utf-8") as requires_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0503c44fc1bd1bb — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:293 
    with open(path_to_lib, "rb") as lib_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #750a947a9d23dc76 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:419 
    if "MACOSX_DEPLOYMENT_TARGET" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2abdd1d2010d7122 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:421 
            int(x) for x in os.environ["MACOSX_DEPLOYMENT_TARGET"].split(".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06901647b968d000 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:474 
        if "MACOSX_DEPLOYMENT_TARGET" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b7061071bcd37f7 — Environment-variable access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/wheelfile.py:53 
    timestamp = int(os.environ.get("SOURCE_DATE_EPOCH", timestamp or time.time()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47febf2a0f04ad97 — Filesystem access.
pkgs/python/[email protected]/setuptools/_vendor/wheel/wheelfile.py:185 
        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b54cab2efb6297f0 — Filesystem access.
pkgs/python/[email protected]/setuptools/archive_util.py:133 
            with open(target, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #acd4bbf648b45761 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/bdist_egg.py:71 
    with open(pyfile, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6d56677565ce041 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/bdist_egg.py:212 
            with open(native_libs, 'wt', encoding="utf-8") as libs_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c8dfc52106e3883 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/bdist_egg.py:363 
            with open(fn, 'wt', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0692daed7517dc4f — Filesystem access.
pkgs/python/[email protected]/setuptools/command/bdist_egg.py:382 
    f = open(filename, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f41fe0117239d31c — Filesystem access.
pkgs/python/[email protected]/setuptools/command/bdist_wheel.py:475 
        with open(wheelfile_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72d54bb8288cfdc3 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/bdist_wheel.py:575 
        with open(dependency_links_path, encoding="utf-8") as dependency_links_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fcbc1d83cfd104f — Environment-variable access.
pkgs/python/[email protected]/setuptools/command/build_ext.py:160 
        so_ext = os.getenv('SETUPTOOLS_EXT_SUFFIX')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d4e7563dcbc5f3d — Filesystem access.
pkgs/python/[email protected]/setuptools/command/build_ext.py:354 
        with open(stub_file, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca8e807722c11744 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/build_py.py:192 
            files = manifest.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0fcb164cd4843356 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/build_py.py:261 
        with open(init_py, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #863f7360e0863734 — Environment-variable access.
pkgs/python/[email protected]/setuptools/command/easy_install.py:18 
            sys_executable=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2081e5cda31d2d04 — Environment-variable access.
pkgs/python/[email protected]/setuptools/command/easy_install.py:18 
            sys_executable=os.environ.get(
                "__PYVENV_LAUNCHER__", os.path.normpath(sys.executable)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ba47869d9cfe047 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/editable_wheel.py:601 
        path1.write_text("file1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2ee10ba8bb3bac8 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/editable_wheel.py:604 
            if path2.is_symlink() and path2.read_text(encoding="utf-8") == "file1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #66f1c35a3e2ebc3b — Filesystem access.
pkgs/python/[email protected]/setuptools/command/egg_info.py:309 
        f = open(filename, 'wb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ce29af41d6f01dc4 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/egg_info.py:671 
    with open(filename, "wb") as f:  # always write POSIX-style manifest

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc06c4a47b95dfaf — Filesystem access.
pkgs/python/[email protected]/setuptools/command/install_scripts.py:64 
        with open(target, "w" + mode, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #119618200a1e0065 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/sdist.py:195 
        with open(self.manifest, 'rb') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7854616c0538061 — Filesystem access.
pkgs/python/[email protected]/setuptools/command/sdist.py:205 
        manifest = open(self.manifest, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f60a9e87f0caa73f — Filesystem access.
pkgs/python/[email protected]/setuptools/command/setopt.py:67 
    with open(filename, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01e2b93eb7221c94 — Environment-variable access.
pkgs/python/[email protected]/setuptools/config/_validate_pyproject/error_reporting.py:81 
        debug_code = os.getenv("JSONSCHEMA_DEBUG_CODE_GENERATION", "false").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #f85ff314b9616252 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/setuptools/config/_validate_pyproject/formats.py:158 
    with urlopen(url, context=context) as response:  # noqa: S310 (audit URLs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #e059d58c92f2dba7 — Environment-variable access.
pkgs/python/[email protected]/setuptools/config/_validate_pyproject/formats.py:192 
        if os.getenv("NO_NETWORK") or os.getenv("VALIDATE_PYPROJECT_NO_NETWORK"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2cb7a2caa572ff9f — Filesystem access.
pkgs/python/[email protected]/setuptools/config/expand.py:57 
        module = ast.parse(pathlib.Path(spec.origin).read_bytes())  # type: ignore[arg-type] # Let it raise an error on None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4430a25f4de4b92 — Filesystem access.
pkgs/python/[email protected]/setuptools/config/expand.py:142 
    with open(filepath, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94956bf18016b8dc — Filesystem access.
pkgs/python/[email protected]/setuptools/config/pyprojecttoml.py:39 
    with open(filepath, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6080aecabdaab7d6 — Filesystem access.
pkgs/python/[email protected]/setuptools/dist.py:586 
            with open(filename, encoding='utf-8') as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab516ee451ddbab4 — Filesystem access.
pkgs/python/[email protected]/setuptools/dist.py:820 
            with open(readme_txt_filename, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a443b1b16e12d71c — Environment-variable access.
pkgs/python/[email protected]/setuptools/installer.py:82 
    quiet = 'PIP_QUIET' not in os.environ and 'PIP_VERBOSE' not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #74653ef36e8e3f9a — Environment-variable access.
pkgs/python/[email protected]/setuptools/installer.py:83 
    if 'PIP_INDEX_URL' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3353fb56053d3470 — Filesystem access.
pkgs/python/[email protected]/setuptools/msvc.py:462 
                with open(state_path, 'rt', encoding='utf-8') as state_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1c414da7acda168 — Filesystem access.
pkgs/python/[email protected]/setuptools/namespaces.py:23 
        with open(filename, 'wt', encoding=py312.PTH_ENCODING) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b464958016f0d5e — Filesystem access.
pkgs/python/[email protected]/setuptools/unicode_utils.py:73 
        with open(file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #307a7e6981f9430f — Filesystem access.
pkgs/python/[email protected]/setuptools/unicode_utils.py:77 
        with open(file, "r", encoding=fallback_encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c13186463d5b47a — Environment-variable access.
pkgs/python/[email protected]/setuptools/warnings.py:109 
    enforce = os.getenv("SETUPTOOLS_ENFORCE_DEPRECATION", "false").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad363624d596b9f6 — Filesystem access.
pkgs/python/[email protected]/setuptools/wheel.py:261 
                    with open(mod_init, 'w', encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e63a11da56ec286a — Environment-variable access.
pkgs/python/[email protected]/tools/build_launchers.py:102 
        os.environ['ProgramFiles(x86)'],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b6853465f4077e9f — Filesystem access.
pkgs/python/[email protected]/tools/finalize.py:39 
    changelog = changelog_fn.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #141ea070eda3b793 — Filesystem access.
pkgs/python/[email protected]/tools/finalize.py:41 
    changelog_fn.write_text(fixed, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

starlette

python dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #10fbb0a403aaf2b9 — Environment-variable access.
pkgs/python/[email protected]/starlette/config.py:19 
    def __init__(self, environ: MutableMapping[str, str] = os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0379871ef72921d9 — Filesystem access.
pkgs/python/[email protected]/starlette/config.py:113 
        with open(file_name, encoding=encoding) as input_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tiktoken

python dependency
expand_more 13 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #65fe0bd77d379e13 — Environment-variable access.
pkgs/python/[email protected]/scripts/benchmark.py:16 
    num_threads = int(os.environ["RAYON_NUM_THREADS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #78a631193bd8a1f7 — Filesystem access.
pkgs/python/[email protected]/scripts/redact.py:11 
    text = path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #536bf1449de0a0f9 — Filesystem access.
pkgs/python/[email protected]/scripts/redact.py:35 
            path.write_text(redacted_text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a54281fa64cf005a — Filesystem access.
pkgs/python/[email protected]/scripts/wheel_download.py:35 
        with open(temp_zip, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #989b410ec97fc557 — Filesystem access.
pkgs/python/[email protected]/tiktoken/_educational.py:212 
    with open(__file__) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #acf415f4b59301ad — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:10 
        with open(blobpath, "rb", buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e1592de643e3273 — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:27 
    return blobfile.read_bytes(blobpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d225acdb747e2133 — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:37 
    if "TIKTOKEN_CACHE_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0169ead044cf5c2 — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:38 
        cache_dir = os.environ["TIKTOKEN_CACHE_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8f3de1372825e30f — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:39 
    elif "DATA_GYM_CACHE_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d951fa173805703 — Environment-variable access.
pkgs/python/[email protected]/tiktoken/load.py:40 
        cache_dir = os.environ["DATA_GYM_CACHE_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #126d1e3957c13ae7 — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:55 
        with open(cache_path, "rb", buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0220eb2fbff96f2 — Filesystem access.
pkgs/python/[email protected]/tiktoken/load.py:78 
        with open(tmp_filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

uvicorn

python dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #ed30ceed3d7b8c6e — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:351 
        if workers is None and "WEB_CONCURRENCY" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aeac7612703fa9a1 — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:352 
            self.workers = int(os.environ["WEB_CONCURRENCY"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cad0b59ffb6fb1c5 — Environment-variable access.
pkgs/python/[email protected]/uvicorn/config.py:356 
            self.forwarded_allow_ips = os.environ.get("FORWARDED_ALLOW_IPS", "127.0.0.1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c12871a4f7582be — Filesystem access.
pkgs/python/[email protected]/uvicorn/config.py:393 
                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c193189a84548d8 — Filesystem access.
pkgs/python/[email protected]/uvicorn/config.py:404 
                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

voyageai

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #aff85f256a58eb51 — Filesystem access.
pkgs/python/[email protected]/voyageai/_base.py:34 
        with open(config_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d35da252750fbda — Environment-variable access.
pkgs/python/[email protected]/voyageai/util.py:13 
VOYAGE_LOG = os.environ.get("VOYAGE_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a1f2df751343678 — Environment-variable access.
pkgs/python/[email protected]/voyageai/util.py:79 
    api_key_path = voyageai.api_key_path or os.environ.get("VOYAGE_API_KEY_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84444c142d46f0a1 — Environment-variable access.
pkgs/python/[email protected]/voyageai/util.py:80 
    api_key = voyageai.api_key or os.environ.get("VOYAGE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aec1996987090c58 — Filesystem access.
pkgs/python/[email protected]/voyageai/util.py:84 
        with open(api_key_path, "rt") as k:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57b78cc00adb8f56 — Filesystem access.
pkgs/python/[email protected]/voyageai/video_utils.py:76 
        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #adcdf44f76aebda5 — Filesystem access.
pkgs/python/[email protected]/voyageai/video_utils.py:164 
        with open(path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f47445f509beae8 — Filesystem access.
pkgs/python/[email protected]/voyageai/video_utils.py:176 
        with open(video, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #690de44dd2c801cc — Filesystem access.
pkgs/python/[email protected]/voyageai/video_utils.py:604 
        with open(out_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

xlsxwriter

python dependency
expand_more 18 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #047830e1c4fd8edb — Filesystem access.
pkgs/python/[email protected]/examples/autofilter.py:30 
textfile = open("autofilter_data.txt", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #857e65c536cd9937 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/images_bytesio.py:27 
image_data = BytesIO(urlopen(url).read())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #df2df3a02ce4f1c5 — Filesystem access.
pkgs/python/[email protected]/examples/images_bytesio.py:38 
image_file = open(filename, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8f7cecbf1e250850 — Filesystem access.
pkgs/python/[email protected]/examples/unicode_polish_utf8.py:16 
with open("unicode_polish_utf8.txt", mode="r", encoding="utf-8") as textfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5a78a6f462fde9f0 — Filesystem access.
pkgs/python/[email protected]/examples/unicode_shift_jis.py:16 
with open("unicode_shift_jis.txt", mode="r", encoding="shift_jis") as textfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #ba99fcbe45827d81 — Filesystem access.
pkgs/python/[email protected]/examples/vba_extract.py:22 
    file = open(filename, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d481c9aef5eceba — Filesystem access.
pkgs/python/[email protected]/setup.py:20 
    long_description=open("README.rst", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35267bd5e1ae8be1 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/image.py:181 
            with open(self.filename, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bdc1069c7f5690c0 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/packager.py:780 
                    os_file = open(os_filename, mode="wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #98c3ef9e5f6031f8 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/packager.py:799 
                    image_file = open(image.filename, mode="rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #79e74c2608eaaa7a — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/packager.py:825 
                os_file = open(os_filename, mode="wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bda02bd3366c38a — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/packager.py:837 
                vba_file = open(vba_project_signature, mode="rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34191ec2a3b78438 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/packager.py:861 
                os_file = open(os_filename, mode="wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5ad835270d70520 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/packager.py:873 
                vba_file = open(vba_project, mode="rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88d257c63e9df875 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/theme.py:55 
            self.fh = open(filename, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #619bb76639a61261 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/worksheet.py:4868 
            self.row_data_fh = open(filename, mode="w+", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #905c2222b5fdd49e — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/worksheet.py:6076 
            self.row_data_fh = open(filename, mode="a+", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cf6b8fb38a3c276 — Filesystem access.
pkgs/python/[email protected]/xlsxwriter/xmlwriter.py:47 
            self.fh = open(filename, "w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

zhipuai

python dependency
expand_more 10 low-confidence finding(s)
low env_fs dependency Excluded from app score #5ab33f2a319e5dda — Environment-variable access.
pkgs/python/[email protected]/zhipuai/_client.py:37 
            api_key = os.environ.get("ZHIPUAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65d1f793eecbac40 — Environment-variable access.
pkgs/python/[email protected]/zhipuai/_client.py:45 
            base_url = os.environ.get("ZHIPUAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f064bfce1517c686 — Environment-variable access.
pkgs/python/[email protected]/zhipuai/core/_base_models.py:57 
            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b054314a9d57013 — Filesystem access.
pkgs/python/[email protected]/zhipuai/core/_files.py:66 
            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e742b04c2252274 — Filesystem access.
pkgs/python/[email protected]/zhipuai/core/_files.py:78 
        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d97da713d036dc3d — Filesystem access.
pkgs/python/[email protected]/zhipuai/core/_legacy_binary_response.py:147 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afcec9743afffded — Filesystem access.
pkgs/python/[email protected]/zhipuai/core/_legacy_binary_response.py:157 
        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b27a05eae01c55a3 — Filesystem access.
pkgs/python/[email protected]/zhipuai/core/_utils/_transform.py:216 
            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea9b73c94de37702 — Filesystem access.
pkgs/python/[email protected]/zhipuai/core/_utils/_transform.py:354 
            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed78af4cc2cc5963 — Filesystem access.
pkgs/python/[email protected]/zhipuai/core/_utils/_utils.py:370 
    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • faiss-cpu prod — no sdist (wheels only)
  • pymilvus prod — no sdist (wheels only)
  • llama-index prod — no python source in sdist
  • ragas prod — sdist exceeds byte cap