Close Open Privacy Scan

link https://github.com/SYSTRAN/faster-whisper
bolt Snapshot: commit ed9a06c
science engine v3
schedule 2026-07-12T15:06:07.149252+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 162 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 162 low
First-party packages: 1
Dependency packages: 4
Ecosystem: python

swap_horiz External domains

api-inference.huggingface.coconsoledonottrack.com

</> First-Party Code

first-party (python)

python first-party
expand_more 6 low-confidence finding(s)
low env_fs test-only #5cf6389b84f499f6 — Filesystem access.
repo/benchmark/evaluate_yt_commons.py:46 
with open(os.path.join(os.path.dirname(__file__), "normalizer.json"), "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only #85fc2e8aefefa9e6 — Filesystem access.
repo/benchmark/wer_benchmark.py:28 
with open(os.path.join(os.path.dirname(__file__), "normalizer.json"), "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df5a6bfe138beb0b — Filesystem access.
repo/faster_whisper/transcribe.py:736 
                with open(config_path, "r", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6935648cef3070ef — Filesystem access.
repo/setup.py:10 
    with open(readme_path, encoding="utf-8") as readme_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2dbd36104d1f3b6f — Filesystem access.
repo/setup.py:17 
    with open(version_path, encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef6b1986d0fb4269 — Filesystem access.
repo/setup.py:23 
    with open(path, encoding="utf-8") as requirements:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

av

python dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #f57cb98613827c4b — Environment-variable access.
pkgs/python/[email protected]/av/datasets.py:14 
        yield os.environ["PYAV_TESTDATA_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88e46bcbb6192539 — Filesystem access.
pkgs/python/[email protected]/av/datasets.py:88 
    with open(tmp_path, "wb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12155f5aae1e426d — Filesystem access.
pkgs/python/[email protected]/av/video/frame.py:711 
        with open(filepath, "w", options={"update": "1"}) as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #17c930b4a6c1b322 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:35 
with open("../av/about.py") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #38656d613eeccabb — Environment-variable access.
pkgs/python/[email protected]/examples/basics/hw_decode.py:24 
HW_DEVICE = os.environ["HW_DEVICE"] if "HW_DEVICE" in os.environ else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #47427c3bb1630871 — Environment-variable access.
pkgs/python/[email protected]/examples/basics/hw_decode.py:26 
if "TEST_FILE_PATH" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #80d549e18053b395 — Environment-variable access.
pkgs/python/[email protected]/examples/basics/hw_decode.py:27 
    test_file_path = os.environ["TEST_FILE_PATH"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #714ccc848729ce6e — Filesystem access.
pkgs/python/[email protected]/examples/basics/parse.py:26 
fh = open(h264_path, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #060cef10776aa9bd — Environment-variable access.
pkgs/python/[email protected]/setup.py:82 
    pkg_config = os.environ.get("PKG_CONFIG", "pkg-config")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

huggingface_hub

python dependency
expand_more 121 low-confidence finding(s)
low env_fs dependency Excluded from app score #5a384222f6e0ece8 — Filesystem access.
pkgs/python/[email protected]/setup.py:6 
    with open(rel_path, "r") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c17db8e5427f166 — Filesystem access.
pkgs/python/[email protected]/setup.py:107 
    long_description=open("README.md", "r", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1a5e22fd9e7687b — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/__init__.py:1231 
if os.environ.get("EAGER_IMPORT", ""):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfd90e1597b91a30 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_buckets.py:386 
    with open(filter_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e324d8b68484e86 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_buckets.py:837 
    with open(plan_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2cd9480e5005983b — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_buckets.py:843 
    with open(plan_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #630b4add1e285c12 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_commit_api.py:269 
                with open(self.path_or_fileobj, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a646ff9b5f281550 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_local_folder.py:446 
                gitignore.write_text("*")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d37c08973a1aabdc — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_local_folder.py:467 
            tag_path.write_text(CACHEDIR_TAG_CONTENT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f5b18488c5f4294 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_oauth.py:183 
    if os.getenv("SPACE_ID") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54a6c291231cf9ce — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_oauth.py:319 
                host = os.environ.get("SPACE_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f6f4f550c266d19 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_oidc.py:48 
    if os.environ.get("GITHUB_ACTIONS") == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49d204fbcb0d5fa1 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_oidc.py:59 
    request_url = os.environ.get("ACTIONS_ID_TOKEN_REQUEST_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94104e552b0fb092 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_oidc.py:60 
    request_token = os.environ.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1425f8d81754506c — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_sandbox.py:214 
            self._write_ranges(path, Path(local_path).read_bytes(), mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6cf03fc25f782ed3 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_sandbox.py:216 
        with open(local_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ae1f497b4f946b8 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_sandbox.py:223 
            with open(local_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f1ca761c673e14e — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_sandbox.py:228 
            with open(local_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc18674ecba9798a — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_snapshot_download.py:303 
                with open(ref_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2497474991a924da — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_snapshot_download.py:411 
            with open(ref_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcdf1014ddf015e2 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_snapshot_download.py:655 
        with open(ref_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57253d992174254e — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/_tree_cache.py:106 
        with open(path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3751f4873375d0de — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_webhooks_server.py:39 
_is_local = os.environ.get("SPACE_ID") is None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad155c2790d52bca — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_webhooks_server.py:111 
        self.webhook_secret = webhook_secret or os.getenv("WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14bbb2a23d6b0c03 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/_webhooks_server.py:181 
        space_host = os.environ.get("SPACE_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1707589b5728190d — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_cli_utils.py:100 
            formatter.write_text(line)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #812cbf6c5a02ce92 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_cli_utils.py:800 
    extended_environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4824543f387b42b5 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_cli_utils.py:818 
        env_map.update(load_dotenv(Path(env_file).read_text(), environ=extended_environ))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47b607f7750c7b29 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_completion.py:46 
    return Path(os.environ.get("SHELL", "")).name or "bash"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d3ca5b32e1d5d9b — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_completion.py:73 
        path.write_text(_completion_script("fish"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c210be7402b5e641 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_completion.py:77 
        existing = path.read_text() if path.exists() else ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e52ee1058012d3e — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_cp.py:156 
            with open(tmp_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3faeaf7dceaf5af — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_skills.py:65 
        (install_dir / "SKILL.md").write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17641087a8c702ea — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/_skills.py:183 
        parsed = json.loads(local_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf096db5ec603e67 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/discussions.py:76 
        return body_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7b8018c4842b446 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/extensions.py:78 
        data = json.loads(manifest_path.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2b75a64a59bbf71 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/extensions.py:89 
        manifest_path.write_text(json.dumps(data, indent=2, sort_keys=True))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e039b18c40d47f24 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/cli/hf.py:122 
    if _COMPLETE_VAR not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d47fd34285ac72b — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/cli/lfs.py:140 
        with open(filepath, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7343b49b44e1c0ea — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/cli/spaces.py:857 
        if command := os.getenv(env, "").strip():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c835d9df0fd9f8fd — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:64 
_staging_mode = _is_true(os.environ.get("HUGGINGFACE_CO_STAGING"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b28505520ef1431a — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:68 
ENDPOINT = os.getenv("HF_ENDPOINT", _HF_DEFAULT_ENDPOINT).rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c37f1dc2d6f7b160 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:98 
INFERENCE_ENDPOINT = os.environ.get("HF_INFERENCE_ENDPOINT", "https://api-inference.huggingface.co")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41e9b2316c3533e5 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:170 
        os.getenv(
            "HF_HOME",
            os.path.join(os.getenv("XDG_CACHE_HOME", default_home), "huggingface"),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b14810654e804d32 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:172 
            os.path.join(os.getenv("XDG_CACHE_HOME", default_home), "huggingface"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24b2375ea11515cf — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:181 
HUGGINGFACE_HUB_CACHE = os.getenv("HUGGINGFACE_HUB_CACHE", default_cache_path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #327ea64fd2bac934 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:182 
HUGGINGFACE_ASSETS_CACHE = os.getenv("HUGGINGFACE_ASSETS_CACHE", default_assets_cache_path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90664586a340eaed — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:187 
        os.getenv(
            "HF_HUB_CACHE",
            HUGGINGFACE_HUB_CACHE,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41aaf1b605386930 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:195 
        os.getenv(
            "HF_ASSETS_CACHE",
            HUGGINGFACE_ASSETS_CACHE,
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4620954218408356 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:202 
HF_HUB_OFFLINE = _is_true(os.environ.get("HF_HUB_OFFLINE") or os.environ.get("TRANSFORMERS_OFFLINE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bef59481d1c479da — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:233 
HF_HUB_DISABLE_UPDATE_CHECK = _is_true(os.environ.get("HF_HUB_DISABLE_UPDATE_CHECK"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c42dfbe4448e4de8 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:237 
HF_DEBUG = _is_true(os.environ.get("HF_DEBUG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a837d52d01b5811 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:241 
    _is_true(os.environ.get("HF_HUB_DISABLE_TELEMETRY"))  # HF-specific env variable

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3bf6be18e4d1148e — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:242 
    or _is_true(os.environ.get("DISABLE_TELEMETRY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fd29a62ae54811e — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:243 
    or _is_true(os.environ.get("DO_NOT_TRACK"))  # https://consoledonottrack.com/

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #012d8457f50a2932 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:248 
        os.getenv(
            "HF_TOKEN_PATH",
            os.path.join(HF_HOME, "token"),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ec23cd2b30f8ce6 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:269 
__HF_HUB_DISABLE_PROGRESS_BARS = os.environ.get("HF_HUB_DISABLE_PROGRESS_BARS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fba34571004b716e — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:275 
HF_HUB_DISABLE_SYMLINKS: bool = _is_true(os.environ.get("HF_HUB_DISABLE_SYMLINKS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c255e8d9afa2a365 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:278 
HF_HUB_DISABLE_SYMLINKS_WARNING: bool = _is_true(os.environ.get("HF_HUB_DISABLE_SYMLINKS_WARNING"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39e4971c2b981917 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:281 
HF_HUB_DISABLE_EXPERIMENTAL_WARNING: bool = _is_true(os.environ.get("HF_HUB_DISABLE_EXPERIMENTAL_WARNING"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #693df4e0a8ffdfd8 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:284 
HF_HUB_DISABLE_IMPLICIT_TOKEN: bool = _is_true(os.environ.get("HF_HUB_DISABLE_IMPLICIT_TOKEN"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eaee2792e2627471 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:286 
HF_XET_HIGH_PERFORMANCE: bool = _is_true(os.environ.get("HF_XET_HIGH_PERFORMANCE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8506a5e472a8bc48 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:295 
if _is_true(os.environ.get("HF_HUB_ENABLE_HF_TRANSFER")) and not HF_XET_HIGH_PERFORMANCE:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #459685661ac3f737 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:306 
HF_HUB_ETAG_TIMEOUT: int = _as_int(os.environ.get("HF_HUB_ETAG_TIMEOUT")) or DEFAULT_ETAG_TIMEOUT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc6a7a07033f50f6 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:310 
HF_HUB_DOWNLOAD_TIMEOUT: int = _as_int(os.environ.get("HF_HUB_DOWNLOAD_TIMEOUT")) or DEFAULT_DOWNLOAD_TIMEOUT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cc4bdce49dc68a0 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:313 
HF_HUB_USER_AGENT_ORIGIN: str | None = os.environ.get("HF_HUB_USER_AGENT_ORIGIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71fcc305c1bba4cd — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:320 
OAUTH_CLIENT_ID = os.environ.get("OAUTH_CLIENT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fedb44eabdeab4a3 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:321 
OAUTH_CLIENT_SECRET = os.environ.get("OAUTH_CLIENT_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1034373f6faf092c — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:322 
OAUTH_SCOPES = os.environ.get("OAUTH_SCOPES")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #888e7a6f7f574d3b — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:323 
OPENID_PROVIDER_URL = os.environ.get("OPENID_PROVIDER_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bac067e2726c0469 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:327 
DEVICE_CODE_OAUTH_CLIENT_ID = os.environ.get("HF_DEVICE_CODE_OAUTH_CLIENT_ID", "26be6b09-91c5-47da-9861-d2d2bb7a7e36")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6359926af50164b — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:338 
HF_XET_CACHE = os.getenv("HF_XET_CACHE", default_xet_cache_path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8131b07bb0753ee3 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/constants.py:339 
HF_HUB_DISABLE_XET: bool = _is_true(os.environ.get("HF_HUB_DISABLE_XET"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #691bbc61c346856f — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/fastai_utils.py:267 
        with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33642ab81dd37644 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/file_download.py:706 
        if not ref_path.exists() or commit_hash != ref_path.read_text():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5a0a8fd718477e3 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/file_download.py:713 
            tmp_path.write_text(commit_hash)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #929f388e6b6e19e7 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/file_download.py:1122 
                    with open(ref_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2909cea18abab455 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/file_download.py:1395 
            with open(paths.file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c8649550ac9f8c6 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/file_download.py:1542 
            with open(revision_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83468834e60bd4cd — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/hf_api.py:6797 
            with open(index_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #499399b947f19322 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/hf_api.py:11347 
                content=relpath_to_abspath["README.md"].read_text(encoding="utf8"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a469addd857d3a9 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/hf_api.py:14650 
    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f144a52daad3a6fa — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/hf_api.py:14742 
        with open(index_file_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #713035dd0ec4b8ff — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/hf_file_system.py:1111 
            outfile = open(lpath, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdae3d65659634c0 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/hub_mixin.py:433 
                config_path.write_text(config_str)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99eca8607e55c6e6 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/hub_mixin.py:523 
            with open(config_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ddf38d5ea7d23b7f — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/inference/_common.py:172 
        return MimeBytes(content.read_bytes(), mime_type=mimetypes.guess_type(content)[0])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7ed3d7348b0c8e63 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/inference/_mcp/cli.py:119 
                    final_value = os.getenv(env_variable_key, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43f9ae5c7eab8d80 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/inference/_mcp/utils.py:97 
        config: AgentConfig = json.loads(cfg_file.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aeb30c152309a24b — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/inference/_mcp/utils.py:102 
                prompt = prompt_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76f0a6fc2518aa33 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/inference/_mcp/utils.py:112 
        return json.loads(path.read_text(encoding="utf-8")), None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #895baa247cea5ec4 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/inference/_providers/fal_ai.py:102 
                with open(inputs, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #096865233e7a61eb — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/inference/_providers/wavespeed.py:118 
            with open(inputs, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #529ab3914a0546db — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/lfs.py:93 
            with open(self._source_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7099d80a9dc6a40 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/lfs.py:113 
        with open(path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7631558e21be7a51 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/repocard.py:132 
        with open(filepath, mode="w", newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87b76ef7ac30d3ef — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/repocard.py:274 
            tmp_path.write_text(str(self), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7cf594e378a97e8 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/repocard.py:328 
            template_str = Path(template_path).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d5e68c5c12f176c — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/repocard.py:330 
            template_str = Path(cls.default_template_path).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3f015ad66133e5f — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/repocard.py:516 
    content = Path(local_path).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d89f9d527ed12aa — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/repocard.py:539 
        with open(local_path, newline="", encoding="utf8") as readme:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e32eb496de098f63 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/repocard.py:547 
    with open(local_path, "w", newline="", encoding="utf8") as readme:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91b8a6811ab314cb — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/serialization/_dduf.py:153 
    index = json.loads(entries["model_index.json"].read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #574c24280eda589f — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/serialization/_dduf.py:303 
        return Path(content).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #245dca1a43c388b3 — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/serialization/_torch.py:281 
        with open(os.path.join(save_directory, index_path), "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #795a6ac169c8b47c — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/serialization/_torch.py:510 
    with open(index_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b04a3065df42edfb — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_auth.py:147 
    return _clean_token(os.environ.get("HF_TOKEN") or os.environ.get("HUGGING_FACE_HUB_TOKEN"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93b2f9d1b5f3f89d — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_auth.py:152 
        return _clean_token(Path(constants.HF_TOKEN_PATH).read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #feaefc88cfa1b292 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_auth.py:181 
    resource = os.environ.get("HF_OIDC_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d1ff4c60b37a72b — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_auth.py:198 
        subject_token = os.environ.get("HF_OIDC_ID_TOKEN") or None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f90450a4e1789dad — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_detect_agent.py:90 
            if os.environ.get(var, "").strip() == harness_id:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73f87d9cb4b0b5c2 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_detect_agent.py:96 
        if value := os.environ.get(var, "").strip().lower():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5a61af5299744ce5 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_detect_agent.py:117 
        value = os.environ.get(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11ff4add45590c9e — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_detect_agent.py:173 
        with open(path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a23c36d8416096be — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_detect_agent.py:183 
        with open(path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e549eb5bf07e6a7a — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_runtime.py:313 
    return os.environ.get("VERTEX_PRODUCT") == "COLAB_ENTERPRISE"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3df086f7492c54c7 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_terminal.py:102 
        if os.environ.get("NO_COLOR") or is_agent():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab1b7f535269d8ef — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_verification.py:59 
            return ref_path.read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e4ff94af1cc145c — Filesystem access.
pkgs/python/[email protected]/src/huggingface_hub/utils/_verification.py:65 
        return main_ref.read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a01c1f064358072 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/logging.py:56 
    env_level_str = os.getenv("HF_HUB_VERBOSITY", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffb48d5119d2fe11 — Environment-variable access.
pkgs/python/[email protected]/src/huggingface_hub/utils/tqdm.py:227 
    if os.getenv("TQDM_POSITION") == "-1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tokenizers

python dependency
expand_more 11 low-confidence finding(s)
low env_fs dependency Excluded from app score #0c514262d2091d9d — Environment-variable access.
pkgs/python/[email protected]/bindings/python/benches/test_tiktoken.py:29 
    os.environ["RAYON_NUM_THREADS"] = str(num_threads)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #75f65fef7621e487 — Filesystem access.
pkgs/python/[email protected]/bindings/python/examples/example.py:29 
    with open(args.file, "r") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5b558522840a7476 — Filesystem access.
pkgs/python/[email protected]/bindings/python/scripts/convert.py:52 
    m.ParseFromString(open(filename, "rb").read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6db31787350a0ee8 — Filesystem access.
pkgs/python/[email protected]/bindings/python/scripts/convert.py:342 
    with open(filename, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a24c4c6f8bdd6a10 — Filesystem access.
pkgs/python/[email protected]/bindings/python/scripts/sentencepiece_extractor.py:61 
        with open(self._model, "r") as model_f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #71f14563e0f7b46b — Filesystem access.
pkgs/python/[email protected]/bindings/python/scripts/sentencepiece_extractor.py:134 
        with open(args.vocab_output_path, "w") as vocab_f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #da108d1cafb83c61 — Filesystem access.
pkgs/python/[email protected]/bindings/python/scripts/sentencepiece_extractor.py:135 
            with open(args.merges_output_path, "w") as merges_f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2aad638714f289bc — Filesystem access.
pkgs/python/[email protected]/bindings/python/scripts/spm_parity_check.py:99 
    with open(args.input_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cd67ca04def01511 — Filesystem access.
pkgs/python/[email protected]/bindings/python/scripts/spm_parity_check.py:226 
    with open(args.input_file, "r", encoding="utf-8-sig") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d45fac3325b3b74 — Filesystem access.
pkgs/python/[email protected]/py_src/tokenizers/implementations/sentencepiece_unigram.py:160 
        m.ParseFromString(open(filename, "rb").read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling reachable #bef37867a947ba94 — Filesystem access.
pkgs/python/[email protected]/py_src/tokenizers/tools/visualizer.py:12 
with open(css_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tqdm

python dependency
expand_more 15 low-confidence finding(s)
low env_fs dependency Excluded from app score #5b5c1e7aca00225c — Filesystem access.
pkgs/python/[email protected]/.meta/mkcompletion.py:59 
    (Path(__file__).resolve().parent.parent / 'tqdm' / 'completion.sh').write_text(
        completion, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #108b359b9089f131 — Filesystem access.
pkgs/python/[email protected]/.meta/mkdocs.py:51 
README_rst = (src_dir / '.readme.rst').read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9b670c5ef08a8619 — Filesystem access.
pkgs/python/[email protected]/.meta/mkdocs.py:93 
man = (src_dir / '.tqdm.1.md').read_text() + man

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7da914228d6b8f07 — Filesystem access.
pkgs/python/[email protected]/.meta/mkdocs.py:104 
    (src_dir.parent / 'README.rst').write_text(README_rst, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #188ab5a090263147 — Filesystem access.
pkgs/python/[email protected]/.meta/mksnap.py:65 
    (Path(__file__).resolve().parent.parent / 'snapcraft.yaml').write_text(
        snap_yml.decode('utf-8') if hasattr(snap_yml, 'decode') else snap_yml, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d6555373e3e596a1 — Filesystem access.
pkgs/python/[email protected]/examples/7zx.py:82 
            with open(md, buffering=1) as m:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #abe8e23cc28c8201 — Filesystem access.
pkgs/python/[email protected]/examples/tqdm_requests.py:31 
with open(eg_out, "wb") as fout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #49e26dd897771351 — Filesystem access.
pkgs/python/[email protected]/examples/tqdm_requests.py:44 
    open(eg_out, "wb"), "write",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #362136d4e4ccf227 — Filesystem access.
pkgs/python/[email protected]/examples/tqdm_wget.py:106 
with tqdm.wrapattr(open(eg_out, "wb"), "write",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e9209a3477707cb — Environment-variable access.
pkgs/python/[email protected]/tqdm/autonotebook.py:15 
        if any(i == 'QT_API' or i.startswith('SPYDER') for i in os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d1c197482bd79b9 — Filesystem access.
pkgs/python/[email protected]/tqdm/cli.py:270 
                dst.write_bytes(fi.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb330c966d74d662 — Environment-variable access.
pkgs/python/[email protected]/tqdm/contrib/bells.py:17 
if getenv("TQDM_SLACK_TOKEN") and getenv("TQDM_SLACK_CHANNEL"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f2d2ea8470c62d5 — Environment-variable access.
pkgs/python/[email protected]/tqdm/contrib/bells.py:19 
elif getenv("TQDM_TELEGRAM_TOKEN") and getenv("TQDM_TELEGRAM_CHAT_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ca64da663eb01e27 — Environment-variable access.
pkgs/python/[email protected]/tqdm/contrib/bells.py:21 
elif getenv("TQDM_DISCORD_TOKEN") and getenv("TQDM_DISCORD_CHANNEL_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba01aaa83a4f3abb — Environment-variable access.
pkgs/python/[email protected]/tqdm/utils.py:50 
            (k[i:].lower(), v) for k, v in os.environ.items() if k.startswith(prefix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • ctranslate2 prod — no sdist (wheels only)
  • onnxruntime prod — no sdist (wheels only)